mirror of
https://github.com/vanhoefm/fragattacks.git
synced 2024-11-28 10:18:21 -05:00
Add support for wolfSSL cryptographic library
Allow hostapd/wpa_supplicant to be compiled with the wolfSSL cryptography and TLS library. Signed-off-by: Sean Parkinson <sean@wolfssl.com>
This commit is contained in:
Sean Parkinson
Jouni Malinen
parent
92eb00aec2
commit
fec03f9838
@ -651,7 +651,29 @@ CFLAGS += -DCONFIG_TLSV12
|
||||
NEED_SHA256=y
|
||||
endif
|
||||
|
||||
ifeq ($(CONFIG_TLS), wolfssl)
|
||||
CONFIG_CRYPTO=wolfssl
|
||||
ifdef TLS_FUNCS
|
||||
OBJS += ../src/crypto/tls_wolfssl.o
|
||||
LIBS += -lwolfssl -lm
|
||||
endif
|
||||
OBJS += ../src/crypto/crypto_wolfssl.o
|
||||
HOBJS += ../src/crypto/crypto_wolfssl.o
|
||||
ifdef NEED_FIPS186_2_PRF
|
||||
OBJS += ../src/crypto/fips_prf_wolfssl.o
|
||||
endif
|
||||
NEED_SHA256=y
|
||||
NEED_TLS_PRF_SHA256=y
|
||||
LIBS += -lwolfssl -lm
|
||||
LIBS_h += -lwolfssl -lm
|
||||
ifdef CONFIG_TLS_ADD_DL
|
||||
LIBS += -ldl
|
||||
LIBS_h += -ldl
|
||||
endif
|
||||
endif
|
||||
|
||||
ifeq ($(CONFIG_TLS), openssl)
|
||||
CONFIG_CRYPTO=openssl
|
||||
ifdef TLS_FUNCS
|
||||
OBJS += ../src/crypto/tls_openssl.o
|
||||
OBJS += ../src/crypto/tls_openssl_ocsp.o
|
||||
@ -855,8 +877,10 @@ AESOBJS += ../src/crypto/aes-internal.o ../src/crypto/aes-internal-enc.o
|
||||
endif
|
||||
|
||||
ifneq ($(CONFIG_TLS), openssl)
|
||||
ifneq ($(CONFIG_TLS), wolfssl)
|
||||
AESOBJS += ../src/crypto/aes-wrap.o
|
||||
endif
|
||||
endif
|
||||
ifdef NEED_AES_EAX
|
||||
AESOBJS += ../src/crypto/aes-eax.o
|
||||
NEED_AES_CTR=y
|
||||
@ -881,19 +905,23 @@ endif
|
||||
ifdef NEED_AES_UNWRAP
|
||||
ifneq ($(CONFIG_TLS), openssl)
|
||||
ifneq ($(CONFIG_TLS), linux)
|
||||
ifneq ($(CONFIG_TLS), wolfssl)
|
||||
NEED_AES_DEC=y
|
||||
AESOBJS += ../src/crypto/aes-unwrap.o
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
ifdef NEED_AES_CBC
|
||||
NEED_AES_DEC=y
|
||||
ifneq ($(CONFIG_TLS), openssl)
|
||||
ifneq ($(CONFIG_TLS), linux)
|
||||
ifneq ($(CONFIG_TLS), wolfssl)
|
||||
AESOBJS += ../src/crypto/aes-cbc.o
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
ifdef NEED_AES_DEC
|
||||
ifdef CONFIG_INTERNAL_AES
|
||||
AESOBJS += ../src/crypto/aes-internal-dec.o
|
||||
@ -907,10 +935,12 @@ ifdef NEED_SHA1
|
||||
ifneq ($(CONFIG_TLS), openssl)
|
||||
ifneq ($(CONFIG_TLS), linux)
|
||||
ifneq ($(CONFIG_TLS), gnutls)
|
||||
ifneq ($(CONFIG_TLS), wolfssl)
|
||||
SHA1OBJS += ../src/crypto/sha1.o
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
SHA1OBJS += ../src/crypto/sha1-prf.o
|
||||
ifdef CONFIG_INTERNAL_SHA1
|
||||
SHA1OBJS += ../src/crypto/sha1-internal.o
|
||||
@ -919,8 +949,10 @@ SHA1OBJS += ../src/crypto/fips_prf_internal.o
|
||||
endif
|
||||
endif
|
||||
ifneq ($(CONFIG_TLS), openssl)
|
||||
ifneq ($(CONFIG_TLS), wolfssl)
|
||||
SHA1OBJS += ../src/crypto/sha1-pbkdf2.o
|
||||
endif
|
||||
endif
|
||||
ifdef NEED_T_PRF
|
||||
SHA1OBJS += ../src/crypto/sha1-tprf.o
|
||||
endif
|
||||
@ -936,10 +968,12 @@ endif
|
||||
ifneq ($(CONFIG_TLS), openssl)
|
||||
ifneq ($(CONFIG_TLS), linux)
|
||||
ifneq ($(CONFIG_TLS), gnutls)
|
||||
ifneq ($(CONFIG_TLS), wolfssl)
|
||||
OBJS += ../src/crypto/md5.o
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
|
||||
ifdef NEED_MD5
|
||||
ifdef CONFIG_INTERNAL_MD5
|
||||
@ -955,6 +989,7 @@ endif
|
||||
endif
|
||||
|
||||
ifdef NEED_DES
|
||||
CFLAGS += -DCONFIG_DES
|
||||
ifdef CONFIG_INTERNAL_DES
|
||||
OBJS += ../src/crypto/des-internal.o
|
||||
endif
|
||||
@ -977,10 +1012,12 @@ CFLAGS += -DCONFIG_SHA256
|
||||
ifneq ($(CONFIG_TLS), openssl)
|
||||
ifneq ($(CONFIG_TLS), linux)
|
||||
ifneq ($(CONFIG_TLS), gnutls)
|
||||
ifneq ($(CONFIG_TLS), wolfssl)
|
||||
OBJS += ../src/crypto/sha256.o
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
OBJS += ../src/crypto/sha256-prf.o
|
||||
ifdef CONFIG_INTERNAL_SHA256
|
||||
OBJS += ../src/crypto/sha256-internal.o
|
||||
@ -1003,10 +1040,12 @@ CFLAGS += -DCONFIG_SHA384
|
||||
ifneq ($(CONFIG_TLS), openssl)
|
||||
ifneq ($(CONFIG_TLS), linux)
|
||||
ifneq ($(CONFIG_TLS), gnutls)
|
||||
ifneq ($(CONFIG_TLS), wolfssl)
|
||||
OBJS += ../src/crypto/sha384.o
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
OBJS += ../src/crypto/sha384-prf.o
|
||||
endif
|
||||
ifdef NEED_SHA512
|
||||
@ -1014,10 +1053,12 @@ CFLAGS += -DCONFIG_SHA512
|
||||
ifneq ($(CONFIG_TLS), openssl)
|
||||
ifneq ($(CONFIG_TLS), linux)
|
||||
ifneq ($(CONFIG_TLS), gnutls)
|
||||
ifneq ($(CONFIG_TLS), wolfssl)
|
||||
OBJS += ../src/crypto/sha512.o
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
OBJS += ../src/crypto/sha512-prf.o
|
||||
endif
|
||||
|
||||
@ -1056,10 +1097,12 @@ HOBJS += ../src/utils/eloop.o
|
||||
HOBJS += $(SHA1OBJS)
|
||||
ifneq ($(CONFIG_TLS), openssl)
|
||||
ifneq ($(CONFIG_TLS), linux)
|
||||
ifneq ($(CONFIG_TLS), wolfssl)
|
||||
HOBJS += ../src/crypto/md5.o
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
|
||||
ifdef CONFIG_RADIUS_SERVER
|
||||
CFLAGS += -DRADIUS_SERVER
|
||||
@ -1250,7 +1293,8 @@ endif
|
||||
ifdef CONFIG_INTERNAL_MD5
|
||||
NOBJS += ../src/crypto/md5-internal.o
|
||||
endif
|
||||
NOBJS += ../src/crypto/crypto_openssl.o ../src/utils/os_$(CONFIG_OS).o
|
||||
NOBJS += ../src/crypto/crypto_$(CONFIG_CRYPTO).o
|
||||
NOBJS += ../src/utils/os_$(CONFIG_OS).o
|
||||
NOBJS += ../src/utils/wpa_debug.o
|
||||
NOBJS += ../src/utils/wpabuf.o
|
||||
ifdef CONFIG_WPA_TRACE
|
||||
|
||||
1670
src/crypto/crypto_wolfssl.c
Normal file
1670
src/crypto/crypto_wolfssl.c
Normal file
File diff suppressed because it is too large
Load Diff
86
src/crypto/fips_prf_wolfssl.c
Normal file
86
src/crypto/fips_prf_wolfssl.c
Normal file
@ -0,0 +1,86 @@
|
||||
/*
|
||||
* FIPS 186-2 PRF for libcrypto
|
||||
* Copyright (c) 2004-2017, Jouni Malinen <j@w1.fi>
|
||||
*
|
||||
* This software may be distributed under the terms of the BSD license.
|
||||
* See README for more details.
|
||||
*/
|
||||
|
||||
#include "includes.h"
|
||||
#include <wolfssl/wolfcrypt/sha.h>
|
||||
|
||||
#include "common.h"
|
||||
#include "crypto.h"
|
||||
|
||||
|
||||
static void sha1_transform(u32 *state, const u8 data[64])
|
||||
{
|
||||
Sha sha;
|
||||
|
||||
os_memset(&sha, 0, sizeof(sha));
|
||||
sha.digest[0] = state[0];
|
||||
sha.digest[1] = state[1];
|
||||
sha.digest[2] = state[2];
|
||||
sha.digest[3] = state[3];
|
||||
sha.digest[4] = state[4];
|
||||
wc_ShaUpdate(&sha, data, 64);
|
||||
state[0] = sha.digest[0];
|
||||
state[1] = sha.digest[1];
|
||||
state[2] = sha.digest[2];
|
||||
state[3] = sha.digest[3];
|
||||
state[4] = sha.digest[4];
|
||||
}
|
||||
|
||||
|
||||
int fips186_2_prf(const u8 *seed, size_t seed_len, u8 *x, size_t xlen)
|
||||
{
|
||||
u8 xkey[64];
|
||||
u32 t[5], _t[5];
|
||||
int i, j, m, k;
|
||||
u8 *xpos = x;
|
||||
u32 carry;
|
||||
|
||||
if (seed_len < sizeof(xkey))
|
||||
os_memset(xkey + seed_len, 0, sizeof(xkey) - seed_len);
|
||||
else
|
||||
seed_len = sizeof(xkey);
|
||||
|
||||
/* FIPS 186-2 + change notice 1 */
|
||||
|
||||
os_memcpy(xkey, seed, seed_len);
|
||||
t[0] = 0x67452301;
|
||||
t[1] = 0xEFCDAB89;
|
||||
t[2] = 0x98BADCFE;
|
||||
t[3] = 0x10325476;
|
||||
t[4] = 0xC3D2E1F0;
|
||||
|
||||
m = xlen / 40;
|
||||
for (j = 0; j < m; j++) {
|
||||
/* XSEED_j = 0 */
|
||||
for (i = 0; i < 2; i++) {
|
||||
/* XVAL = (XKEY + XSEED_j) mod 2^b */
|
||||
|
||||
/* w_i = G(t, XVAL) */
|
||||
os_memcpy(_t, t, 20);
|
||||
sha1_transform(_t, xkey);
|
||||
WPA_PUT_BE32(xpos, _t[0]);
|
||||
WPA_PUT_BE32(xpos + 4, _t[1]);
|
||||
WPA_PUT_BE32(xpos + 8, _t[2]);
|
||||
WPA_PUT_BE32(xpos + 12, _t[3]);
|
||||
WPA_PUT_BE32(xpos + 16, _t[4]);
|
||||
|
||||
/* XKEY = (1 + XKEY + w_i) mod 2^b */
|
||||
carry = 1;
|
||||
for (k = 19; k >= 0; k--) {
|
||||
carry += xkey[k] + xpos[k];
|
||||
xkey[k] = carry & 0xff;
|
||||
carry >>= 8;
|
||||
}
|
||||
|
||||
xpos += 20;
|
||||
}
|
||||
/* x_j = w_0|w_1 */
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
2150
src/crypto/tls_wolfssl.c
Normal file
2150
src/crypto/tls_wolfssl.c
Normal file
File diff suppressed because it is too large
Load Diff
@ -709,6 +709,9 @@ endif
|
||||
|
||||
ifdef CONFIG_EAP_PWD
|
||||
CFLAGS += -DEAP_PWD
|
||||
ifeq ($(CONFIG_TLS), wolfssl)
|
||||
CFLAGS += -DCONFIG_ECC
|
||||
endif
|
||||
OBJS += ../src/eap_peer/eap_pwd.o ../src/eap_common/eap_pwd_common.o
|
||||
CONFIG_IEEE8021X_EAPOL=y
|
||||
NEED_SHA256=y
|
||||
@ -1054,6 +1057,20 @@ CFLAGS += -DCONFIG_TLSV12
|
||||
NEED_SHA256=y
|
||||
endif
|
||||
|
||||
ifeq ($(CONFIG_TLS), wolfssl)
|
||||
ifdef TLS_FUNCS
|
||||
CFLAGS += -DWOLFSSL_DER_LOAD -I/usr/local/include/wolfssl
|
||||
OBJS += ../src/crypto/tls_wolfssl.o
|
||||
endif
|
||||
OBJS += ../src/crypto/crypto_wolfssl.o
|
||||
OBJS_p += ../src/crypto/crypto_wolfssl.o
|
||||
ifdef NEED_FIPS186_2_PRF
|
||||
OBJS += ../src/crypto/fips_prf_wolfssl.o
|
||||
endif
|
||||
LIBS += -lwolfssl -lm
|
||||
LIBS_p += -lwolfssl -lm
|
||||
endif
|
||||
|
||||
ifeq ($(CONFIG_TLS), openssl)
|
||||
ifdef TLS_FUNCS
|
||||
CFLAGS += -DEAP_TLS_OPENSSL
|
||||
@ -1274,8 +1291,10 @@ AESOBJS += ../src/crypto/aes-internal.o ../src/crypto/aes-internal-dec.o
|
||||
endif
|
||||
|
||||
ifneq ($(CONFIG_TLS), openssl)
|
||||
ifneq ($(CONFIG_TLS), wolfssl)
|
||||
NEED_INTERNAL_AES_WRAP=y
|
||||
endif
|
||||
endif
|
||||
ifdef CONFIG_OPENSSL_INTERNAL_AES_WRAP
|
||||
# Seems to be needed at least with BoringSSL
|
||||
NEED_INTERNAL_AES_WRAP=y
|
||||
@ -1314,10 +1333,12 @@ ifdef CONFIG_OPENSSL_CMAC
|
||||
CFLAGS += -DCONFIG_OPENSSL_CMAC
|
||||
else
|
||||
ifneq ($(CONFIG_TLS), linux)
|
||||
ifneq ($(CONFIG_TLS), wolfssl)
|
||||
AESOBJS += ../src/crypto/aes-omac1.o
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
ifdef NEED_AES_WRAP
|
||||
NEED_AES_ENC=y
|
||||
ifdef NEED_INTERNAL_AES_WRAP
|
||||
@ -1328,10 +1349,12 @@ ifdef NEED_AES_CBC
|
||||
NEED_AES_ENC=y
|
||||
ifneq ($(CONFIG_TLS), openssl)
|
||||
ifneq ($(CONFIG_TLS), linux)
|
||||
ifneq ($(CONFIG_TLS), wolfssl)
|
||||
AESOBJS += ../src/crypto/aes-cbc.o
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
ifdef NEED_AES_ENC
|
||||
ifdef CONFIG_INTERNAL_AES
|
||||
AESOBJS += ../src/crypto/aes-internal-enc.o
|
||||
@ -1345,10 +1368,12 @@ ifdef NEED_SHA1
|
||||
ifneq ($(CONFIG_TLS), openssl)
|
||||
ifneq ($(CONFIG_TLS), linux)
|
||||
ifneq ($(CONFIG_TLS), gnutls)
|
||||
ifneq ($(CONFIG_TLS), wolfssl)
|
||||
SHA1OBJS += ../src/crypto/sha1.o
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
SHA1OBJS += ../src/crypto/sha1-prf.o
|
||||
ifdef CONFIG_INTERNAL_SHA1
|
||||
SHA1OBJS += ../src/crypto/sha1-internal.o
|
||||
@ -1360,9 +1385,11 @@ ifdef CONFIG_NO_WPA_PASSPHRASE
|
||||
CFLAGS += -DCONFIG_NO_PBKDF2
|
||||
else
|
||||
ifneq ($(CONFIG_TLS), openssl)
|
||||
ifneq ($(CONFIG_TLS), wolfssl)
|
||||
SHA1OBJS += ../src/crypto/sha1-pbkdf2.o
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
ifdef NEED_T_PRF
|
||||
SHA1OBJS += ../src/crypto/sha1-tprf.o
|
||||
endif
|
||||
@ -1375,11 +1402,13 @@ ifndef CONFIG_FIPS
|
||||
ifneq ($(CONFIG_TLS), openssl)
|
||||
ifneq ($(CONFIG_TLS), linux)
|
||||
ifneq ($(CONFIG_TLS), gnutls)
|
||||
ifneq ($(CONFIG_TLS), wolfssl)
|
||||
MD5OBJS += ../src/crypto/md5.o
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
ifdef NEED_MD5
|
||||
ifdef CONFIG_INTERNAL_MD5
|
||||
MD5OBJS += ../src/crypto/md5-internal.o
|
||||
@ -1397,6 +1426,9 @@ endif
|
||||
|
||||
DESOBJS = # none needed when not internal
|
||||
ifdef NEED_DES
|
||||
ifndef CONFIG_FIPS
|
||||
CFLAGS += -DCONFIG_DES
|
||||
endif
|
||||
ifdef CONFIG_INTERNAL_DES
|
||||
DESOBJS += ../src/crypto/des-internal.o
|
||||
endif
|
||||
@ -1420,10 +1452,12 @@ CFLAGS += -DCONFIG_SHA256
|
||||
ifneq ($(CONFIG_TLS), openssl)
|
||||
ifneq ($(CONFIG_TLS), linux)
|
||||
ifneq ($(CONFIG_TLS), gnutls)
|
||||
ifneq ($(CONFIG_TLS), wolfssl)
|
||||
SHA256OBJS += ../src/crypto/sha256.o
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
SHA256OBJS += ../src/crypto/sha256-prf.o
|
||||
ifdef CONFIG_INTERNAL_SHA256
|
||||
SHA256OBJS += ../src/crypto/sha256-internal.o
|
||||
@ -1457,10 +1491,12 @@ ifdef NEED_SHA384
|
||||
ifneq ($(CONFIG_TLS), openssl)
|
||||
ifneq ($(CONFIG_TLS), linux)
|
||||
ifneq ($(CONFIG_TLS), gnutls)
|
||||
ifneq ($(CONFIG_TLS), wolfssl)
|
||||
OBJS += ../src/crypto/sha384.o
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
CFLAGS += -DCONFIG_SHA384
|
||||
OBJS += ../src/crypto/sha384-prf.o
|
||||
endif
|
||||
@ -1468,10 +1504,12 @@ ifdef NEED_SHA512
|
||||
ifneq ($(CONFIG_TLS), openssl)
|
||||
ifneq ($(CONFIG_TLS), linux)
|
||||
ifneq ($(CONFIG_TLS), gnutls)
|
||||
ifneq ($(CONFIG_TLS), wolfssl)
|
||||
OBJS += ../src/crypto/sha512.o
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
CFLAGS += -DCONFIG_SHA512
|
||||
OBJS += ../src/crypto/sha512-prf.o
|
||||
endif
|
||||
@ -1668,9 +1706,11 @@ endif
|
||||
ifdef CONFIG_FIPS
|
||||
CFLAGS += -DCONFIG_FIPS
|
||||
ifneq ($(CONFIG_TLS), openssl)
|
||||
ifneq ($(CONFIG_TLS), wolfssl)
|
||||
$(error CONFIG_FIPS=y requires CONFIG_TLS=openssl)
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
|
||||
OBJS += $(SHA1OBJS) $(DESOBJS)
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user