Skip to content

Commit 55e966f

Browse files
inoway46inoway46
authored
build: support LIEF 0.17.x and 1.x
Keep bundled LIEF at 0.17.0 while selecting the Mach-O section API from the headers in use and the bundled build settings by version. Prepare the updater for Mbed TLS 4 and TF-PSA-Crypto so the vendor update can land separately. Assisted-by: Codex Signed-off-by: inoway46 <inoueyuya416@gmail.com> PR-URL: #66240 Fixes: #66238 Refs: #66242 Refs: #63530 Refs: nodejs/nodejs-dependency-vuln-assessments#360 Refs: nodejs/nodejs-dependency-vuln-assessments#342 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com>
1 parent 7d79ed3 commit 55e966f

3 files changed

Lines changed: 192 additions & 2 deletions

File tree

‎deps/LIEF/lief.gyp‎

Lines changed: 164 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@
1313
},
1414
},
1515
'variables': {
16+
# Read the bundled version; shared LIEF is selected through its own headers.
17+
'lief_version_major': '<!("<(python)" -c "print([line.split()[2] for line in open(\'include/LIEF/version.h\') if line.startswith(\'#define LIEF_VERSION_MAJOR \')][0])")',
1618
'lief_sources': [
1719
# Root
1820
'src/Object.cpp',
@@ -411,6 +413,117 @@
411413
'third-party/mbedtls/library/x509write.c',
412414
'third-party/mbedtls/library/x509write_crt.c',
413415
'third-party/mbedtls/library/x509write_csr.c',
416+
],
417+
'lief_1_third_party_sources': [
418+
# Sources from upstream cmake/LIEFDependencies.cmake (Mbed TLS 4).
419+
'third-party/mbedtls/library/debug.c',
420+
'third-party/mbedtls/library/mps_reader.c',
421+
'third-party/mbedtls/library/mps_trace.c',
422+
'third-party/mbedtls/library/net_sockets.c',
423+
'third-party/mbedtls/library/pkcs7.c',
424+
'third-party/mbedtls/library/ssl_cache.c',
425+
'third-party/mbedtls/library/ssl_ciphersuites.c',
426+
'third-party/mbedtls/library/ssl_client.c',
427+
'third-party/mbedtls/library/ssl_cookie.c',
428+
'third-party/mbedtls/library/ssl_msg.c',
429+
'third-party/mbedtls/library/ssl_ticket.c',
430+
'third-party/mbedtls/library/ssl_tls.c',
431+
'third-party/mbedtls/library/ssl_tls12_client.c',
432+
'third-party/mbedtls/library/ssl_tls12_server.c',
433+
'third-party/mbedtls/library/ssl_tls13_client.c',
434+
'third-party/mbedtls/library/ssl_tls13_generic.c',
435+
'third-party/mbedtls/library/ssl_tls13_keys.c',
436+
'third-party/mbedtls/library/ssl_tls13_server.c',
437+
'third-party/mbedtls/library/timing.c',
438+
'third-party/mbedtls/library/version.c',
439+
'third-party/mbedtls/library/error.c',
440+
'third-party/mbedtls/library/x509.c',
441+
'third-party/mbedtls/library/x509_create.c',
442+
'third-party/mbedtls/library/x509_crl.c',
443+
'third-party/mbedtls/library/x509_crt.c',
444+
'third-party/mbedtls/library/x509_csr.c',
445+
'third-party/mbedtls/library/x509_oid.c',
446+
'third-party/mbedtls/library/x509write.c',
447+
'third-party/mbedtls/library/x509write_crt.c',
448+
'third-party/mbedtls/library/x509write_csr.c',
449+
'third-party/mbedtls/tf-psa-crypto/core/psa_crypto.c',
450+
'third-party/mbedtls/tf-psa-crypto/core/psa_crypto_client.c',
451+
'third-party/mbedtls/tf-psa-crypto/core/psa_crypto_slot_management.c',
452+
'third-party/mbedtls/tf-psa-crypto/core/psa_crypto_storage.c',
453+
'third-party/mbedtls/tf-psa-crypto/core/psa_its_file.c',
454+
'third-party/mbedtls/tf-psa-crypto/core/tf_psa_crypto_config.c',
455+
'third-party/mbedtls/tf-psa-crypto/core/tf_psa_crypto_version.c',
456+
'third-party/mbedtls/tf-psa-crypto/core/psa_crypto_driver_wrappers_no_static.c',
457+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/aes.c',
458+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/aesce.c',
459+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/aesni.c',
460+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/aria.c',
461+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/asn1parse.c',
462+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/asn1write.c',
463+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/base64.c',
464+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/bignum.c',
465+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/bignum_core.c',
466+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/bignum_mod.c',
467+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/bignum_mod_raw.c',
468+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/block_cipher.c',
469+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/camellia.c',
470+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/ccm.c',
471+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/chacha20.c',
472+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/chachapoly.c',
473+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/cipher.c',
474+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/cipher_wrap.c',
475+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/cmac.c',
476+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/constant_time.c',
477+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/ctr_drbg.c',
478+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/ecdh.c',
479+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/ecdsa.c',
480+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/ecjpake.c',
481+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/ecp.c',
482+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/ecp_curves.c',
483+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/ecp_curves_new.c',
484+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/entropy.c',
485+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/entropy_poll.c',
486+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/gcm.c',
487+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/hmac_drbg.c',
488+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/lmots.c',
489+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/lms.c',
490+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/md.c',
491+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/md5.c',
492+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/memory_buffer_alloc.c',
493+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/nist_kw.c',
494+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/oid.c',
495+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/pem.c',
496+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/pk.c',
497+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/pk_ecc.c',
498+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/pk_rsa.c',
499+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/pk_wrap.c',
500+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/pkcs5.c',
501+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/pkparse.c',
502+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/pkwrite.c',
503+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/platform.c',
504+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/platform_util.c',
505+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/poly1305.c',
506+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/psa_crypto_aead.c',
507+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/psa_crypto_cipher.c',
508+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/psa_crypto_ecp.c',
509+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/psa_crypto_ffdh.c',
510+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/psa_crypto_hash.c',
511+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/psa_crypto_mac.c',
512+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/psa_crypto_pake.c',
513+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/psa_crypto_rsa.c',
514+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/psa_util.c',
515+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/ripemd160.c',
516+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/rsa.c',
517+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/rsa_alt_helpers.c',
518+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/sha1.c',
519+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/sha256.c',
520+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/sha3.c',
521+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/sha512.c',
522+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src/threading.c',
523+
'third-party/mbedtls/tf-psa-crypto/drivers/everest/library/everest.c',
524+
'third-party/mbedtls/tf-psa-crypto/drivers/everest/library/x25519.c',
525+
'third-party/mbedtls/tf-psa-crypto/drivers/p256-m/p256-m/p256-m.c',
526+
'third-party/mbedtls/tf-psa-crypto/drivers/p256-m/p256-m_driver_entrypoints.c',
414527
]
415528
},
416529
'targets': [
@@ -444,7 +557,6 @@
444557
'defines': [
445558
'LIEF_STATIC',
446559
'MBEDTLS_CONFIG_FILE="config/mbedtls/config.h"',
447-
'MBEDTLS_NO_PLATFORM_ENTROPY',
448560
'SPDLOG_DISABLE_DEFAULT_LOGGER',
449561
'SPDLOG_NO_EXCEPTIONS',
450562
'SPDLOG_FUNCTION=""',
@@ -487,7 +599,57 @@
487599
},
488600
'sources': [
489601
'<@(lief_sources)',
490-
'<@(lief_third_party_sources)',
602+
],
603+
'conditions': [
604+
['lief_version_major >= 1', {
605+
'sources': [
606+
'src/DebugDeclOpt.cpp',
607+
'src/mbedtls_init.cpp',
608+
'src/threading_alt.cpp',
609+
'src/BinaryStream/DumpStream.cpp',
610+
'src/ELF/DynamicEntryAuxiliary.cpp',
611+
'src/ELF/DynamicEntryFilter.cpp',
612+
'src/ELF/elf_utils.cpp',
613+
'src/ELF/layout_check.cpp',
614+
'src/ELF/NoteDetails/properties/Needed.cpp',
615+
'src/MachO/LazyLoadDylibInfo.cpp',
616+
'src/MachO/ThreadLocalVariables.cpp',
617+
# Stubs for disabled LIEF_RUNTIME_SUPPORT.
618+
'src/runtime/android/no_runtime.cpp',
619+
'src/runtime/disassembler/no_assembler.cpp',
620+
'src/runtime/disassembler/no_disassembler.cpp',
621+
'src/runtime/linux/no_runtime.cpp',
622+
'src/runtime/linux_android_shared/no_runtime.cpp',
623+
'src/runtime/no_runtime.cpp',
624+
'src/runtime/osx/common.cpp',
625+
'src/runtime/osx/no_runtime.cpp',
626+
'src/runtime/windows/common.cpp',
627+
'src/runtime/windows/no_runtime.cpp',
628+
'<@(lief_1_third_party_sources)',
629+
],
630+
'include_dirs': [
631+
'src/runtime',
632+
'third-party/mbedtls/tf-psa-crypto/include',
633+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/include',
634+
'third-party/mbedtls/tf-psa-crypto/core',
635+
'third-party/mbedtls/tf-psa-crypto/drivers/builtin/src',
636+
'third-party/mbedtls/tf-psa-crypto/drivers/everest/include/tf-psa-crypto/private/everest',
637+
'third-party/mbedtls/tf-psa-crypto/drivers/everest/include/tf-psa-crypto/private/everest/kremlib',
638+
],
639+
'defines': [
640+
'TF_PSA_CRYPTO_USER_CONFIG_FILE="config/mbedtls/psa_config.h"',
641+
],
642+
'conditions': [
643+
['OS=="win"', {
644+
'link_settings': {
645+
'libraries': [ '-lbcrypt' ],
646+
},
647+
}],
648+
],
649+
}, {
650+
'sources': [ '<@(lief_third_party_sources)' ],
651+
'defines': [ 'MBEDTLS_NO_PLATFORM_ENTROPY' ],
652+
}],
491653
],
492654
}
493655
]

‎src/node_sea_bin.cc‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
#else // defined(DEBUG)
1212
#include "LIEF/LIEF.hpp"
1313
#endif // defined(DEBUG)
14+
#include "LIEF/version.h"
1415
#endif // HAVE_LIEF
1516

1617
#include "debug_utils-inl.h"
@@ -175,8 +176,13 @@ InjectOutput InjectIntoMachO(const std::vector<uint8_t>& executable,
175176
LIEF::MachO::SegmentCommand::VM_PROTECTIONS::READ));
176177
new_segment.init_protection(static_cast<uint32_t>(
177178
LIEF::MachO::SegmentCommand::VM_PROTECTIONS::READ));
179+
#if LIEF_VERSION_MAJOR >= 1
180+
auto section = LIEF::MachO::Section::create(section_name, data);
181+
new_segment.add_section(*section);
182+
#else
178183
LIEF::MachO::Section section(section_name, data);
179184
new_segment.add_section(section);
185+
#endif
180186
binary.add(new_segment);
181187
} else {
182188
// Check if the section exists
@@ -191,8 +197,13 @@ InjectOutput InjectIntoMachO(const std::vector<uint8_t>& executable,
191197
segment_name,
192198
section_name)};
193199
}
200+
#if LIEF_VERSION_MAJOR >= 1
201+
auto section = LIEF::MachO::Section::create(section_name, data);
202+
binary.add_section(*segment, *section);
203+
#else
194204
LIEF::MachO::Section section(section_name, data);
195205
binary.add_section(*segment, section);
206+
#endif
196207
}
197208

198209
// It will need to be signed again anyway, so remove the signature
@@ -295,7 +306,15 @@ InjectOutput InjectIntoPE(const std::vector<uint8_t>& executable,
295306
cfg.resources = true;
296307
cfg.rsrc_section = ".rsrc"; // ensure section name
297308
LIEF::PE::Builder builder(*binary, cfg);
309+
#if LIEF_VERSION_MAJOR >= 1
310+
// LIEF 1.0.0 does not export the result's bool conversion in shared builds.
311+
// TODO(inoway46): Remove this workaround once the upstream issue is fixed.
312+
// https://github.com/lief-project/LIEF/issues/1387
313+
builder.build();
314+
if (builder.get_build().empty()) {
315+
#else
298316
if (!builder.build()) {
317+
#endif
299318
return {InjectResult::kError, {}, "Failed to build modified PE binary"};
300319
}
301320

‎tools/prepare_lief.py‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -173,6 +173,9 @@ def main():
173173
# Move the allow-listed directories from each lib in tmp_third_party to dst_third_party
174174
src = tmp_third_party / lib
175175
dst = dst_third_party / lib
176+
if lib == 'mbedtls' and (src / 'tf-psa-crypto').is_dir():
177+
included = included + ['tf-psa-crypto/core', 'tf-psa-crypto/include',
178+
'tf-psa-crypto/drivers', 'tf-psa-crypto/LICENSE']
176179
for subpath in included:
177180
src_item = src / subpath
178181
dst_item = dst / subpath
@@ -187,6 +190,11 @@ def main():
187190
dst_item.unlink()
188191
print(f"Moving {src_item} -> {dst_item}")
189192
shutil.move(str(src_item), str(dst_item))
193+
if lib == 'mbedtls' and subpath.startswith('tf-psa-crypto/') and dst_item.is_dir():
194+
# The release archive includes generated sources that must be
195+
# checked in, despite the upstream development ignore rules.
196+
for gitignore in dst_item.rglob('.gitignore'):
197+
gitignore.unlink()
190198

191199
# 2) Place internal headers expected by the project layout under src/
192200
# - third-party/expected/include/tl/expected.hpp
@@ -269,6 +277,7 @@ def main():
269277
'LIEF_DYLD_SHARED_CACHE_SUPPORT': 0,
270278
'LIEF_ASM_SUPPORT': 0,
271279
'LIEF_EXTENDED': 0,
280+
'LIEF_RUNTIME_SUPPORT': 0,
272281

273282
'ENABLE_JSON_SUPPORT': 0,
274283
'LIEF_JSON_SUPPORT': 0,

0 commit comments

Comments
 (0)