Skip to content

Commit

Permalink
Merge pull request #8370 from douzzer/20250120-lean-fips
Browse files Browse the repository at this point in the history 
20250120-lean-fips
  • Loading branch information
@dgarske
dgarske authored Jan 25, 2025
2 parents ca92284 + f7abd7c commit 0932891
Show file tree
Hide file tree
Showing 17 changed files with 136 additions and 75 deletions.
4 changes: 2 additions & 2 deletions configure.ac
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5951,7 +5951,7 @@ then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHAKE128"
if test "$ENABLED_SHA3" = "no"
then
AC_MSG_ERROR([Must have SHA-3 enabled: --enable-sha3])
AC_MSG_ERROR([shake128 requires SHA-3: --enable-sha3])
fi
else
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NO_SHAKE128"
Expand All @@ -5967,7 +5967,7 @@ then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHAKE256"
if test "$ENABLED_SHA3" = "no"
then
AC_MSG_ERROR([Must have SHA-3 enabled: --enable-sha3])
AC_MSG_ERROR([shake256 requires SHA-3: --enable-sha3])
fi
else
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NO_SHAKE256"
Expand Down
57 changes: 32 additions & 25 deletions linuxkm/module_hooks.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -244,6 +244,38 @@ static int wolfssl_init(void)
}
return -ECANCELED;
}
#endif /* HAVE_FIPS */

#ifdef WC_RNG_SEED_CB
ret = wc_SetSeed_Cb(wc_GenerateSeed);
if (ret < 0) {
pr_err("wc_SetSeed_Cb() failed with return code %d.\n", ret);
(void)libwolfssl_cleanup();
msleep(10);
return -ECANCELED;
}
#endif

#ifdef WOLFCRYPT_ONLY
ret = wolfCrypt_Init();
if (ret != 0) {
pr_err("wolfCrypt_Init() failed: %s\n", wc_GetErrorString(ret));
return -ECANCELED;
}
#else
ret = wolfSSL_Init();
if (ret != WOLFSSL_SUCCESS) {
pr_err("wolfSSL_Init() failed: %s\n", wc_GetErrorString(ret));
return -ECANCELED;
}
#endif

#ifdef HAVE_FIPS
ret = wc_RunAllCast_fips();
if (ret != 0) {
pr_err("wc_RunAllCast_fips() failed with return value %d\n", ret);
return -ECANCELED;
}

pr_info("FIPS 140-3 wolfCrypt-fips v%d.%d.%d%s%s startup "
"self-test succeeded.\n",
Expand All @@ -270,33 +302,8 @@ static int wolfssl_init(void)
""
#endif
);

#endif /* HAVE_FIPS */

#ifdef WC_RNG_SEED_CB
ret = wc_SetSeed_Cb(wc_GenerateSeed);
if (ret < 0) {
pr_err("wc_SetSeed_Cb() failed with return code %d.\n", ret);
(void)libwolfssl_cleanup();
msleep(10);
return -ECANCELED;
}
#endif

#ifdef WOLFCRYPT_ONLY
ret = wolfCrypt_Init();
if (ret != 0) {
pr_err("wolfCrypt_Init() failed: %s\n", wc_GetErrorString(ret));
return -ECANCELED;
}
#else
ret = wolfSSL_Init();
if (ret != WOLFSSL_SUCCESS) {
pr_err("wolfSSL_Init() failed: %s\n", wc_GetErrorString(ret));
return -ECANCELED;
}
#endif

#ifndef NO_CRYPT_TEST
ret = wolfcrypt_test(NULL);
if (ret < 0) {
Expand Down
30 changes: 20 additions & 10 deletions src/internal.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -25300,16 +25300,21 @@ static int ssl_in_handshake(WOLFSSL *ssl, int send)
return 0;
}

int SendData(WOLFSSL* ssl, const void* data, int sz)
int SendData(WOLFSSL* ssl, const void* data, size_t sz)
{
int sent = 0, /* plainText size */
sendSz,
word32 sent = 0; /* plainText size */
int sendSz,
ret;
#if defined(WOLFSSL_EARLY_DATA) && defined(WOLFSSL_EARLY_DATA_GROUP)
int groupMsgs = 0;
#endif
int error = ssl->error;

if (sz > INT_MAX) {
WOLFSSL_MSG("SendData sz overflow");
return WOLFSSL_FATAL_ERROR;
}

if (error == WC_NO_ERR_TRACE(WANT_WRITE)
#ifdef WOLFSSL_ASYNC_CRYPT
|| error == WC_NO_ERR_TRACE(WC_PENDING_E)
Expand Down Expand Up @@ -25414,7 +25419,7 @@ int SendData(WOLFSSL* ssl, const void* data, int sz)
sent = ssl->buffers.prevSent + ssl->buffers.plainSz;
WOLFSSL_MSG("sent write buffered data");

if (sent > sz) {
if (sent > (word32)sz) {
WOLFSSL_MSG("error: write() after WANT_WRITE with short size");
return (ssl->error = BAD_FUNC_ARG);
}
Expand Down Expand Up @@ -25503,19 +25508,19 @@ int SendData(WOLFSSL* ssl, const void* data, int sz)

#ifdef WOLFSSL_DTLS
if (ssl->options.dtls) {
buffSz = wolfSSL_GetMaxFragSize(ssl, sz - sent);
buffSz = wolfSSL_GetMaxFragSize(ssl, (word32)sz - sent);
}
else
#endif
{
buffSz = wolfSSL_GetMaxFragSize(ssl, sz - sent);
buffSz = wolfSSL_GetMaxFragSize(ssl, (word32)sz - sent);

}

if (sent == sz) break;
if (sent == (word32)sz) break;

#if defined(WOLFSSL_DTLS) && !defined(WOLFSSL_NO_DTLS_SIZE_CHECK)
if (ssl->options.dtls && (buffSz < sz - sent)) {
if (ssl->options.dtls && ((size_t)buffSz < (word32)sz - sent)) {
error = DTLS_SIZE_ERROR;
ssl->error = error;
WOLFSSL_ERROR(error);
Expand Down Expand Up @@ -25686,13 +25691,18 @@ int SendData(WOLFSSL* ssl, const void* data, int sz)
}

/* process input data */
int ReceiveData(WOLFSSL* ssl, byte* output, int sz, int peek)
int ReceiveData(WOLFSSL* ssl, byte* output, size_t sz, int peek)
{
int size;
int error = ssl->error;

WOLFSSL_ENTER("ReceiveData");

if (sz > INT_MAX) {
WOLFSSL_MSG("ReceiveData sz overflow");
return WOLFSSL_FATAL_ERROR;
}

/* reset error state */
if (error == WC_NO_ERR_TRACE(WANT_READ) ||
error == WOLFSSL_ERROR_WANT_READ) {
Expand Down Expand Up @@ -25842,7 +25852,7 @@ int ReceiveData(WOLFSSL* ssl, byte* output, int sz, int peek)
#endif
}

size = (int)min((word32)sz, ssl->buffers.clearOutputBuffer.length);
size = (int)min_size_t(sz, (size_t)ssl->buffers.clearOutputBuffer.length);

XMEMCPY(output, ssl->buffers.clearOutputBuffer.buffer, size);

Expand Down
68 changes: 47 additions & 21 deletions src/ssl.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2970,14 +2970,13 @@ int wolfSSL_GetDhKey_Sz(WOLFSSL* ssl)
#endif /* !NO_DH */


WOLFSSL_ABI
int wolfSSL_write(WOLFSSL* ssl, const void* data, int sz)
static int wolfSSL_write_internal(WOLFSSL* ssl, const void* data, size_t sz)
{
int ret;

WOLFSSL_ENTER("wolfSSL_write");

if (ssl == NULL || data == NULL || sz < 0)
if (ssl == NULL || data == NULL)
return BAD_FUNC_ARG;

#ifdef WOLFSSL_QUIC
Expand Down Expand Up @@ -3037,6 +3036,17 @@ int wolfSSL_write(WOLFSSL* ssl, const void* data, int sz)
return ret;
}

WOLFSSL_ABI
int wolfSSL_write(WOLFSSL* ssl, const void* data, int sz)
{
WOLFSSL_ENTER("wolfSSL_write");

if (sz < 0)
return BAD_FUNC_ARG;

return wolfSSL_write_internal(ssl, data, (size_t)sz);
}

int wolfSSL_inject(WOLFSSL* ssl, const void* data, int sz)
{
int maxLength;
Expand Down Expand Up @@ -3074,15 +3084,15 @@ int wolfSSL_inject(WOLFSSL* ssl, const void* data, int sz)
}


int wolfSSL_write_ex(WOLFSSL* ssl, const void* data, int sz, size_t* wr)
int wolfSSL_write_ex(WOLFSSL* ssl, const void* data, size_t sz, size_t* wr)
{
int ret;

if (wr != NULL) {
*wr = 0;
}

ret = wolfSSL_write(ssl, data, sz);
ret = wolfSSL_write_internal(ssl, data, sz);
if (ret >= 0) {
if (wr != NULL) {
*wr = (size_t)ret;
Expand All @@ -3093,7 +3103,7 @@ int wolfSSL_write_ex(WOLFSSL* ssl, const void* data, int sz, size_t* wr)
if (ret == 0 && ssl->options.partialWrite) {
ret = 0;
}
else if (ret < sz && !ssl->options.partialWrite) {
else if ((size_t)ret < sz && !ssl->options.partialWrite) {
ret = 0;
}
else {
Expand All @@ -3110,13 +3120,13 @@ int wolfSSL_write_ex(WOLFSSL* ssl, const void* data, int sz, size_t* wr)
}


static int wolfSSL_read_internal(WOLFSSL* ssl, void* data, int sz, int peek)
static int wolfSSL_read_internal(WOLFSSL* ssl, void* data, size_t sz, int peek)
{
int ret;

WOLFSSL_ENTER("wolfSSL_read_internal");

if (ssl == NULL || data == NULL || sz < 0)
if (ssl == NULL || data == NULL)
return BAD_FUNC_ARG;

#ifdef WOLFSSL_QUIC
Expand Down Expand Up @@ -3194,7 +3204,10 @@ int wolfSSL_peek(WOLFSSL* ssl, void* data, int sz)
{
WOLFSSL_ENTER("wolfSSL_peek");

return wolfSSL_read_internal(ssl, data, sz, TRUE);
if (sz < 0)
return BAD_FUNC_ARG;

return wolfSSL_read_internal(ssl, data, (size_t)sz, TRUE);
}


Expand All @@ -3203,6 +3216,9 @@ int wolfSSL_read(WOLFSSL* ssl, void* data, int sz)
{
WOLFSSL_ENTER("wolfSSL_read");

if (sz < 0)
return BAD_FUNC_ARG;

#ifdef OPENSSL_EXTRA
if (ssl == NULL) {
return BAD_FUNC_ARG;
Expand All @@ -3212,16 +3228,26 @@ int wolfSSL_read(WOLFSSL* ssl, void* data, int sz)
ssl->cbmode = WOLFSSL_CB_READ;
}
#endif
return wolfSSL_read_internal(ssl, data, sz, FALSE);
return wolfSSL_read_internal(ssl, data, (size_t)sz, FALSE);
}


/* returns 0 on failure and on no read */
int wolfSSL_read_ex(WOLFSSL* ssl, void* data, int sz, size_t* rd)
int wolfSSL_read_ex(WOLFSSL* ssl, void* data, size_t sz, size_t* rd)
{
int ret;
int ret;

#ifdef OPENSSL_EXTRA
if (ssl == NULL) {
return BAD_FUNC_ARG;
}
if (ssl->CBIS != NULL) {
ssl->CBIS(ssl, WOLFSSL_CB_READ, WOLFSSL_SUCCESS);
ssl->cbmode = WOLFSSL_CB_READ;
}
#endif
ret = wolfSSL_read_internal(ssl, data, sz, FALSE);

ret = wolfSSL_read(ssl, data, sz);
if (ret > 0 && rd != NULL) {
*rd = (size_t)ret;
}
Expand All @@ -3238,10 +3264,10 @@ int wolfSSL_mcast_read(WOLFSSL* ssl, word16* id, void* data, int sz)

WOLFSSL_ENTER("wolfSSL_mcast_read");

if (ssl == NULL)
if ((ssl == NULL) || (sz < 0))
return BAD_FUNC_ARG;

ret = wolfSSL_read_internal(ssl, data, sz, FALSE);
ret = wolfSSL_read_internal(ssl, data, (size_t)sz, FALSE);
if (ssl->options.dtls && ssl->options.haveMcast && id != NULL)
*id = ssl->keys.curPeerId;
return ret;
Expand Down Expand Up @@ -11302,19 +11328,19 @@ int wolfSSL_set_compression(WOLFSSL* ssl)
#endif
byte* myBuffer = staticBuffer;
int dynamic = 0;
int sending = 0;
word32 sending = 0;
int idx = 0;
int i;
int ret;

WOLFSSL_ENTER("wolfSSL_writev");

for (i = 0; i < iovcnt; i++)
sending += (int)iov[i].iov_len;
sending += iov[i].iov_len;

if (sending > (int)sizeof(staticBuffer)) {
myBuffer = (byte*)XMALLOC((size_t)sending, ssl->heap,
DYNAMIC_TYPE_WRITEV);
if (sending > sizeof(staticBuffer)) {
myBuffer = (byte*)XMALLOC(sending, ssl->heap,
DYNAMIC_TYPE_WRITEV);
if (!myBuffer)
return MEMORY_ERROR;

Expand All @@ -11331,7 +11357,7 @@ int wolfSSL_set_compression(WOLFSSL* ssl)
*/
PRAGMA_GCC_DIAG_PUSH
PRAGMA_GCC("GCC diagnostic ignored \"-Wmaybe-uninitialized\"")
ret = wolfSSL_write(ssl, myBuffer, sending);
ret = wolfSSL_write_internal(ssl, myBuffer, sending);
PRAGMA_GCC_DIAG_POP

if (dynamic)
Expand Down
2 changes: 1 addition & 1 deletion src/tls13.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14887,7 +14887,7 @@ int wolfSSL_read_early_data(WOLFSSL* ssl, void* data, int sz, int* outSz)
return WOLFSSL_FATAL_ERROR;
}
if (ssl->options.handShakeState == SERVER_FINISHED_COMPLETE) {
ret = ReceiveData(ssl, (byte*)data, sz, FALSE);
ret = ReceiveData(ssl, (byte*)data, (size_t)sz, FALSE);
if (ret > 0)
*outSz = ret;
if (ssl->error == WC_NO_ERR_TRACE(ZERO_RETURN)) {
Expand Down
2 changes: 1 addition & 1 deletion wolfcrypt/benchmark/benchmark.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -586,7 +586,7 @@
#undef LIBCALL_CHECK_RET
#if defined(NO_STDIO_FILESYSTEM) || defined(NO_ERROR_STRINGS) || \
defined(NO_MAIN_DRIVER) || defined(BENCH_EMBEDDED)
#define LIBCALL_CHECK_RET(...) __VA_ARGS__
#define LIBCALL_CHECK_RET(...) (void)(__VA_ARGS__)
#else
#define LIBCALL_CHECK_RET(...) do { \
int _libcall_ret = (__VA_ARGS__); \
Expand Down
2 changes: 1 addition & 1 deletion wolfcrypt/src/aes.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6886,7 +6886,7 @@ void GHASH(Gcm* gcm, const byte* a, word32 aSz, const byte* c,
#define GHASH_ONE_BLOCK_SW(aes, block) \
do { \
xorbuf(AES_TAG(aes), block, WC_AES_BLOCK_SIZE); \
GMULT(AES_TAG(aes), aes->gcm.H); \
GMULT(AES_TAG(aes), (aes)->gcm.H); \
} \
while (0)
#endif /* WOLFSSL_AESGCM_STREAM */
Expand Down
Loading

0 comments on commit 0932891

Please sign in to comment.