denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

wolfssl: Updates to resolve build conflicts

Browse Source 
The wolfSSL's OpenSSL compatibility layer is not used by the plugin at
all and preventing its inclusion avoids conflicts with ASN1_ constants.

The inclusion of wolfssl/ssl.h is moved to the only file that requires
it as older wolfSSL versions defined a conflicting ASN1_GENERALIZEDTIME.

Other changes address issues with the FIPS use case.

Closes strongswan/strongswan#1332
This commit is contained in:
Tim Weller
2022-11-10 16:23:44 +01:00
committed by Tobias Brunner
parent 7db77fd32b
commit af71f14ba3
3 changed files with 23 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/wolfssl/wolfssl_common.h
+9 -20
View File
@@ -47,20 +47,18 @@
/* PARSE_ERROR is an enum entry in wolfSSL - not used in this plugin */
#define PARSE_ERROR WOLFSSL_PARSE_ERROR
/* Remap unused enums from the OpenSSL compatibility layer to avoid conflicts */
#define ASN1_BOOLEAN REMAP_ASN1_BOOLEAN
#define ASN1_OID REMAP_ASN1_OID
#define ASN1_INTEGER REMAP_ASN1_INTEGER
#define ASN1_BIT_STRING REMAP_ASN1_BIT_STRING
#define ASN1_IA5STRING REMAP_ASN1_IA5STRING
#define ASN1_OCTET_STRING REMAP_ASN1_OCTET_STRING
#define ASN1_UTCTIME REMAP_ASN1_UTCTIME
#define ASN1_GENERALIZEDTIME REMAP_ASN1_GENERALIZEDTIME
#ifndef WOLFSSL_USER_SETTINGS
#include <wolfssl/options.h>
#endif
#include <wolfssl/ssl.h>
/* Disable inclusion of the wolfSSL OpenSSL compatibility layer header (if
* configured) as it is not used by the plugin and causes conflicts */
#define WOLFSSL_OPENSSL_H_
#if defined(HAVE_FIPS) && \
(defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2))
#include <wolfssl/wolfcrypt/fips_test.h>
#endif
/* Special type used to handle EdDSA keys depending on config options */
#if defined(HAVE_ED25519) || defined(HAVE_ED448)
@@ -82,15 +80,6 @@ typedef union {
#undef PARSE_ERROR
#undef ASN1_BOOLEAN
#undef ASN1_OID
#undef ASN1_INTEGER
#undef ASN1_BIT_STRING
#undef ASN1_IA5STRING
#undef ASN1_OCTET_STRING
#undef ASN1_UTCTIME
#undef ASN1_GENERALIZEDTIME
/* Eliminate macro conflicts */
#undef RNG
src/libstrongswan/plugins/wolfssl/wolfssl_ec_diffie_hellman.c
+10 -3
View File
@@ -31,6 +31,12 @@
#include <utils/debug.h>
#if defined(ECC_TIMING_RESISTANT) && \
(!defined(HAVE_FIPS) || \
(defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 5)))
#define USE_RNG_FOR_TIMING_RESISTANCE
#endif
typedef struct private_wolfssl_ec_diffie_hellman_t private_wolfssl_ec_diffie_hellman_t;
/**
@@ -203,13 +209,14 @@ METHOD(key_exchange_t, set_private_key, bool,
static bool compute_shared_key(private_wolfssl_ec_diffie_hellman_t *this)
{
word32 len;
#ifdef ECC_TIMING_RESISTANT
#ifdef USE_RNG_FOR_TIMING_RESISTANCE
WC_RNG rng;
if (wc_InitRng(&rng) != 0)
{
return FALSE;
}
if (wc_ecc_set_rng(&this->key, &rng) != 0)
{
wc_FreeRng(&rng);
@@ -225,13 +232,13 @@ static bool compute_shared_key(private_wolfssl_ec_diffie_hellman_t *this)
{
DBG1(DBG_LIB, "ECDH shared secret computation failed");
chunk_clear(&this->shared_secret);
#ifdef ECC_TIMING_RESISTANT
#ifdef USE_RNG_FOR_TIMING_RESISTANCE
wc_FreeRng(&rng);
#endif
return FALSE;
}
this->shared_secret.len = len;
#ifdef ECC_TIMING_RESISTANT
#ifdef USE_RNG_FOR_TIMING_RESISTANCE
wc_FreeRng(&rng);
#endif
return TRUE;
src/libstrongswan/plugins/wolfssl/wolfssl_plugin.c
+4 -1
View File
@@ -21,10 +21,11 @@
* THE SOFTWARE.
*/
#include "wolfssl_common.h"
#include <library.h>
#include <utils/debug.h>
#include "wolfssl_common.h"
#include "wolfssl_plugin.h"
#include "wolfssl_aead.h"
#include "wolfssl_crypter.h"
@@ -44,6 +45,8 @@
#include "wolfssl_x_diffie_hellman.h"
#include "wolfssl_xof.h"
#include <wolfssl/ssl.h>
#ifndef FIPS_MODE
#define FIPS_MODE 0
#endif