Zephyr & mbedtls_poly1305 methods

[scath]

Hoping someone can point me towards some guidance on how to properly enable, configure, and build mbedTLS options on the nrf52840.

I'm currently using Zephyr 3.6, with the nrfconnect 2.3.0 toolchain, working in VSCode on Win10.

I'm trying to establish a secure connection to a web endpoint that requires ECDH ciphers. However, when I try to enable them the linker can't find definitions for `mebedtls_poly1305_xxx` methods.

c:/nordic/toolchains/v2.3.0/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.1.0/../../../../arm-zephyr-eabi/bin/ld.exe: modules/mbedtls/libmodules__mbedtls.a(chachapoly.c.obj): in function `chachapoly_pad_aad':
C:\nordic\v2.3.0\modules\crypto\mbedtls\library\chachapoly.c:69: undefined reference to `mbedtls_poly1305_update'
c:/nordic/toolchains/v2.3.0/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.1.0/../../../../arm-zephyr-eabi/bin/ld.exe: modules/mbedtls/libmodules__mbedtls.a(chachapoly.c.obj): in function `mbedtls_chachapoly_init':
C:\nordic\v2.3.0\modules\crypto\mbedtls\library\chachapoly.c:98: undefined reference to `mbedtls_poly1305_init'
c:/nordic/toolchains/v2.3.0/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.1.0/../../../../arm-zephyr-eabi/bin/ld.exe: modules/mbedtls/libmodules__mbedtls.a(chachapoly.c.obj): in function `mbedtls_chachapoly_free':
C:\nordic\v2.3.0\modules\crypto\mbedtls\library\chachapoly.c:111: undefined reference to `mbedtls_poly1305_free'
c:/nordic/toolchains/v2.3.0/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.1.0/../../../../arm-zephyr-eabi/bin/ld.exe: modules/mbedtls/libmodules__mbedtls.a(chachapoly.c.obj): in function `mbedtls_chachapoly_starts':
C:\nordic\v2.3.0\modules\crypto\mbedtls\library\chachapoly.c:155: undefined reference to `mbedtls_poly1305_starts'
c:/nordic/toolchains/v2.3.0/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.1.0/../../../../arm-zephyr-eabi/bin/ld.exe: modules/mbedtls/libmodules__mbedtls.a(chachapoly.c.obj): in function `mbedtls_chachapoly_update_aad':
C:\nordic\v2.3.0\modules\crypto\mbedtls\library\chachapoly.c:182: undefined reference to `mbedtls_poly1305_update'
c:/nordic/toolchains/v2.3.0/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.1.0/../../../../arm-zephyr-eabi/bin/ld.exe: modules/mbedtls/libmodules__mbedtls.a(chachapoly.c.obj): in function `mbedtls_chachapoly_update':
C:\nordic\v2.3.0\modules\crypto\mbedtls\library\chachapoly.c:224: undefined reference to `mbedtls_poly1305_update'
c:/nordic/toolchains/v2.3.0/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.1.0/../../../../arm-zephyr-eabi/bin/ld.exe: C:\nordic\v2.3.0\modules\crypto\mbedtls\library\chachapoly.c:218: undefined reference to `mbedtls_poly1305_update'
c:/nordic/toolchains/v2.3.0/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.1.0/../../../../arm-zephyr-eabi/bin/ld.exe: modules/mbedtls/libmodules__mbedtls.a(chachapoly.c.obj): in function `mbedtls_chachapoly_finish':
C:\nordic\v2.3.0\modules\crypto\mbedtls\library\chachapoly.c:270: undefined reference to `mbedtls_poly1305_update'
c:/nordic/toolchains/v2.3.0/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.1.0/../../../../arm-zephyr-eabi/bin/ld.exe: C:\nordic\v2.3.0\modules\crypto\mbedtls\library\chachapoly.c:274: undefined reference to `mbedtls_poly1305_finish'
c:/nordic/toolchains/v2.3.0/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.1.0/../../../../arm-zephyr-eabi/bin/ld.exe: modules/mbedtls/libmodules__mbedtls.a(chachapoly.c.obj): in function `chachapoly_pad_ciphertext':
C:\nordic\v2.3.0\modules\crypto\mbedtls\library\chachapoly.c:88: undefined reference to `mbedtls_poly1305_update'
collect2.exe: error: ld returned 1 exit status
ninja: build stopped: subcommand failed.

 

I'm reasonably sure I'm missing some kind of simple configuration, but I'm out of ideas on how to proceed next.

Any help?

[Amanda Hsieh]

Hi, 

Try to include the library in the CMakeLists.txt as

target_include_directories(app PRIVATE ${ZEPHYR_BASE}/../modules/fs/crypto/mbedtls/library)

Regards,
Amanda H.

[scath]

Hi there,

This didn't work right away, but did eventually after I hacked through some conflicts via the `guiconfig`.

[alnyland]

Do you mind extrapolating on what solution ended up working for you? This can be helpful to others as well.

[scath]

Hi Al,

I really can't remember as this ticket is from over a year ago.

That said, my shop has moved away from using the VSCode plugin entirely - far too much trouble - and now uses `west` to manage building the project from the command line. You can find documentation on how you can start setting that up here.

We don't use the NCS mbedtls library - that hasn't worked well for us - and instead use an implementation from LairdCP (since we're using the MG100.) To be fair, Laird may simply be passing along some implementation created by Nordic - I can't say for certain.

Doing all of this has allowed us to remove all mentions of ciphers in the project configuration, and instead specify which ones we want to use in the webserver config.

The only lines we have in `prj.conf` for TLS are as follows:

CONFIG_MBEDTLS=y
CONFIG_MBEDTLS_BUILTIN=y
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_HEAP_SIZE=32767
CONFIG_MBEDTLS_SSL_MAX_CONTENT_LEN=4096

Hoping this is helpful - apologies if it's not :/ 

Wishing you well!

[alnyland]

Hey thanks for the quick reply. Yeah I'm starting to go crazy with this - have spent multiple full days trying to fix it.

That's interesting, the plugin worked great a few months ago but has really gone downhill recently. That's too bad you've found it unusable, but I'm not really surprised. I've found mine (and all nRF apps) are having permissions issues now when they used to work just fine - same computer, no relevant settings changes. I've used west independently on other platforms, maybe we'll do that here (it would be nice to grep the build output).

Ok, also good to know. I've seen nRF's MbedTLS does not match Zephyr's, so I'm considering bringing in Zephyr's as a library in my code...

Thanks, I'll compare that to mine and see what happens.

[scath]

No worries - I've been there.

I did look through the autogenerated confs, and I see that by using this config we're basically including all the ciphers. Perhaps not ideal, but it works and we can move on.

Best of luck.