Skip to content

Commit 58167a2

Browse files
JacobBarthelmehJacobBarthelmeh
authored
Merge pull request #7434 from douzzer/20240416-fips-v6-fixes
20240416-fips-v6-fixes
2 parents 03ed52b + 3df11e7 commit 58167a2

10 files changed

Lines changed: 72 additions & 128 deletions

File tree

‎configure.ac‎

Lines changed: 22 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -809,6 +809,8 @@ then
809809
test "$enable_camellia" = "" && enable_camellia=yes
810810
test "$enable_ripemd" = "" && enable_ripemd=yes
811811
test "$enable_sha224" = "" && enable_sha224=yes
812+
test "$enable_sha512" = "" && enable_sha512=yes
813+
test "$enable_sha3" = "" && enable_sha3=yes
812814
test "$enable_shake128" = "" && enable_shake128=yes
813815
test "$enable_shake256" = "" && enable_shake256=yes
814816
test "$enable_sessioncerts" = "" && enable_sessioncerts=yes
@@ -867,12 +869,6 @@ then
867869
test "$enable_ech" = "" && enable_ech=yes
868870
test "$enable_srtp" = "" && enable_srtp=yes
869871

870-
if test "$ENABLED_32BIT" != "yes"
871-
then
872-
test "$enable_sha512" = "" && enable_sha512=yes
873-
test "$enable_sha3" = "" && enable_sha3=yes
874-
fi
875-
876872
if test "$ENABLED_LINUXKM_DEFAULTS" != "yes"
877873
then
878874
test "$enable_compkey" = "" && enable_compkey=yes
@@ -923,13 +919,10 @@ then
923919
test "$enable_pkcs7" = "" && enable_pkcs7=yes
924920
test "$enable_nullcipher" = "" && enable_nullcipher=yes
925921
test "$enable_mcast" = "" && enable_mcast=yes
926-
if test "$ENABLED_32BIT" != "yes"
927-
then
928-
test "$enable_ed25519" = "" && enable_ed25519=yes
929-
test "$enable_ed25519_stream" = "" && test "$enable_ed25519" != "no" && enable_ed25519_stream=yes
930-
test "$enable_ed448" = "" && enable_ed448=yes
931-
test "$enable_ed448_stream" = "" && test "$enable_ed448" != "no" && enable_ed448_stream=yes
932-
fi
922+
test "$enable_ed25519" = "" && enable_ed25519=yes
923+
test "$enable_ed25519_stream" = "" && test "$enable_ed25519" != "no" && enable_ed25519_stream=yes
924+
test "$enable_ed448" = "" && enable_ed448=yes
925+
test "$enable_ed448_stream" = "" && test "$enable_ed448" != "no" && enable_ed448_stream=yes
933926

934927
if test "$ENABLED_LINUXKM_DEFAULTS" != "yes"
935928
then
@@ -1005,6 +998,8 @@ then
1005998
test "$enable_camellia" = "" && enable_camellia=yes
1006999
test "$enable_ripemd" = "" && enable_ripemd=yes
10071000
test "$enable_sha224" = "" && enable_sha224=yes
1001+
test "$enable_sha512" = "" && enable_sha512=yes
1002+
test "$enable_sha3" = "" && enable_sha3=yes
10081003
test "$enable_shake128" = "" && enable_shake128=yes
10091004
test "$enable_shake256" = "" && enable_shake256=yes
10101005
test "$enable_sessioncerts" = "" && enable_sessioncerts=yes
@@ -1047,12 +1042,6 @@ then
10471042
test "$enable_ssh" = "" && test "$enable_hmac" != "no" && enable_ssh=yes
10481043
test "$enable_srtp_kdf" = "" && enable_srtp_kdf=yes
10491044

1050-
if test "$ENABLED_32BIT" != "yes"
1051-
then
1052-
test "$enable_sha512" = "" && enable_sha512=yes
1053-
test "$enable_sha3" = "" && enable_sha3=yes
1054-
fi
1055-
10561045
if test "$ENABLED_LINUXKM_DEFAULTS" != "yes"
10571046
then
10581047
test "$enable_compkey" = "" && enable_compkey=yes
@@ -1074,13 +1063,10 @@ then
10741063
test "$enable_xchacha" = "" && test "$enable_chacha" != "no" && enable_xchacha=yes
10751064
test "$enable_pkcs7" = "" && enable_pkcs7=yes
10761065
test "$enable_nullcipher" = "" && enable_nullcipher=yes
1077-
if test "$ENABLED_32BIT" != "yes"
1078-
then
1079-
test "$enable_ed25519" = "" && enable_ed25519=yes
1080-
test "$enable_ed25519_stream" = "" && test "$enable_ed25519" != "no" && enable_ed25519_stream=yes
1081-
test "$enable_ed448" = "" && enable_ed448=yes
1082-
test "$enable_ed448_stream" = "" && test "$enable_ed448" != "no" && enable_ed448_stream=yes
1083-
fi
1066+
test "$enable_ed25519" = "" && enable_ed25519=yes
1067+
test "$enable_ed25519_stream" = "" && test "$enable_ed25519" != "no" && enable_ed25519_stream=yes
1068+
test "$enable_ed448" = "" && enable_ed448=yes
1069+
test "$enable_ed448_stream" = "" && test "$enable_ed448" != "no" && enable_ed448_stream=yes
10841070

10851071
if test "$ENABLED_LINUXKM_DEFAULTS" != "yes"
10861072
then
@@ -3433,7 +3419,7 @@ fi
34333419
# set sha3 default
34343420
SHA3_DEFAULT=no
34353421
if (test "$host_cpu" = "x86_64" || test "$host_cpu" = "aarch64" ||
3436-
test "$host_cpu" = "amd64") && test "$ENABLED_32BIT" = "no"
3422+
test "$host_cpu" = "amd64")
34373423
then
34383424
if test "x$ENABLED_FIPS" = "xno" || test "$HAVE_FIPS_VERSION" -ge 2
34393425
then
@@ -3475,7 +3461,7 @@ AC_ARG_ENABLE([sha512],
34753461
)
34763462

34773463
# options that don't require sha512
3478-
if test "$ENABLED_LEANPSK" = "yes" || test "$ENABLED_LEANTLS" = "yes" || test "$ENABLED_32BIT" = "yes" || test "$ENABLED_16BIT" = "yes"
3464+
if test "$ENABLED_LEANPSK" = "yes" || test "$ENABLED_LEANTLS" = "yes" || test "$ENABLED_16BIT" = "yes"
34793465
then
34803466
ENABLED_SHA512="no"
34813467
fi
@@ -3501,7 +3487,7 @@ AC_ARG_ENABLE([sha384],
35013487
)
35023488

35033489
# options that don't require sha384
3504-
if test "$ENABLED_LEANPSK" = "yes" || test "$ENABLED_LEANTLS" = "yes" || test "$ENABLED_32BIT" = "yes" || test "$ENABLED_16BIT" = "yes"
3490+
if test "$ENABLED_LEANPSK" = "yes" || test "$ENABLED_LEANTLS" = "yes" || test "$ENABLED_16BIT" = "yes"
35053491
then
35063492
ENABLED_SHA384="no"
35073493
fi
@@ -5363,7 +5349,7 @@ then
53635349
fi
53645350
53655351
# Ed448
5366-
if test "$ENABLED_ED448" != "no" && test "$ENABLED_32BIT" = "no"
5352+
if test "$ENABLED_ED448" != "no"
53675353
then
53685354
if test "$ENABLED_ED448" = "small" || test "$ENABLED_LOWRESOURCE" = "yes"
53695355
then
@@ -5406,7 +5392,7 @@ then
54065392
fi
54075393
54085394
# Set SHA-3 flags
5409-
if test "$ENABLED_SHA3" != "no" && test "$ENABLED_32BIT" = "no"
5395+
if test "$ENABLED_SHA3" != "no"
54105396
then
54115397
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHA3"
54125398
fi
@@ -5416,7 +5402,7 @@ fi
54165402
AS_IF([test "x$ENABLED_FIPS" = "xyes" && test $HAVE_FIPS_VERSION -lt 6],
54175403
[ENABLED_SHAKE128="no"])
54185404
5419-
if test "$ENABLED_SHAKE128" != "no" && test "$ENABLED_32BIT" = "no"
5405+
if test "$ENABLED_SHAKE128" != "no"
54205406
then
54215407
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHAKE128"
54225408
if test "$ENABLED_SHA3" = "no"
@@ -5432,7 +5418,7 @@ fi
54325418
AS_IF([test "x$ENABLED_FIPS" = "xyes" && test $HAVE_FIPS_VERSION -lt 6],
54335419
[ENABLED_SHAKE256="no"])
54345420
5435-
if test "$ENABLED_SHAKE256" != "no" && test "$ENABLED_32BIT" = "no"
5421+
if test "$ENABLED_SHAKE256" != "no"
54365422
then
54375423
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHAKE256"
54385424
if test "$ENABLED_SHA3" = "no"
@@ -8667,7 +8653,7 @@ then
86678653
ENABLED_OPENSSLEXTRA="yes"
86688654
fi
86698655
8670-
if test "$ENABLED_ED25519" != "no" && test "$ENABLED_32BIT" = "no"
8656+
if test "$ENABLED_ED25519" != "no"
86718657
then
86728658
if test "$ENABLED_ED25519" = "small" || test "$ENABLED_LOWRESOURCE" = "yes"
86738659
then
@@ -8835,9 +8821,9 @@ AS_IF([test "x$ENABLED_CERTGEN" = "xyes"],
88358821
AS_IF([test "x$ENABLED_CERTEXT" = "xyes"],
88368822
[AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CERT_EXT"])
88378823
8838-
AS_IF([test "x$ENABLED_ED25519" = "xyes" && test "x$ENABLED_32BIT" = "xno"],
8824+
AS_IF([test "x$ENABLED_ED25519" = "xyes"],
88398825
[AM_CFLAGS="$AM_CFLAGS -DHAVE_ED25519"])
8840-
AS_IF([test "x$ENABLED_ED25519" = "xyes" && test "x$ENABLED_32BIT" = "xno"],
8826+
AS_IF([test "x$ENABLED_ED25519" = "xyes"],
88418827
[AM_CCASFLAGS="$AM_CCASFLAGS -DHAVE_ED25519"])
88428828
88438829
AS_IF([test "x$ENABLED_ED25519_SMALL" = "xyes"],

‎scripts/aria-cmake-build-test.sh‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -115,8 +115,7 @@ build_aria_test() {
115115

116116
# View the available ciphers with:
117117
echo "checking wolfsl client ssl version numbers SSLv3(0) - TLS1.3(4):"
118-
./examples/client/client -V
119-
if [ $? -eq 0 ]; then
118+
if ./examples/client/client -V; then
120119
echo "Confirmed ./examples/client/client operational."
121120
else
122121
echo "ERROR ./examples/client/client error = $?"

‎src/pk.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16198,7 +16198,7 @@ int wolfSSL_PEM_write_bio_PKCS8PrivateKey(WOLFSSL_BIO* bio,
1619816198
int passwdSz, wc_pem_password_cb* cb, void* ctx)
1619916199
{
1620016200
byte* pem = NULL;
16201-
int pemSz;
16201+
int pemSz = 0;
1620216202
int res = 1;
1620316203

1620416204
/* Validate parameters. */
@@ -16243,7 +16243,7 @@ int wolfSSL_PEM_write_PKCS8PrivateKey(XFILE f, WOLFSSL_EVP_PKEY* pkey,
1624316243
wc_pem_password_cb* cb, void* ctx)
1624416244
{
1624516245
byte* pem = NULL;
16246-
int pemSz;
16246+
int pemSz = 0;
1624716247
int res = 1;
1624816248

1624916249
/* Validate parameters. */

‎src/ssl_load.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1529,7 +1529,7 @@ static void ProcessBufferCertSetHave(WOLFSSL_CTX* ctx, WOLFSSL* ssl,
15291529
if (ssl != NULL) {
15301530
ssl->pkCurveOID = cert->pkCurveOID;
15311531
}
1532-
else {
1532+
else if (ctx) {
15331533
ctx->pkCurveOID = cert->pkCurveOID;
15341534
}
15351535
#endif
@@ -1540,7 +1540,7 @@ static void ProcessBufferCertSetHave(WOLFSSL_CTX* ctx, WOLFSSL* ssl,
15401540
if (ssl != NULL) {
15411541
ssl->options.haveECC = ssl->options.haveECDSAsig;
15421542
}
1543-
else {
1543+
else if (ctx) {
15441544
ctx->haveECC = ctx->haveECDSAsig;
15451545
}
15461546
#endif /* !WC_STRICT_SIG */

‎wolfcrypt/src/aes.c‎

Lines changed: 4 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -12726,19 +12726,8 @@ int wc_AesXtsEncrypt(XtsAes* xaes, byte* out, const byte* in, word32 sz,
1272612726

1272712727
{
1272812728
#ifdef WOLFSSL_AESNI
12729-
#ifdef WC_AES_C_DYNAMIC_FALLBACK
12730-
int orig_use_aesni = aes->use_aesni;
12731-
#endif
12732-
12733-
if (aes->use_aesni && ((ret = SAVE_VECTOR_REGISTERS2()) != 0)) {
12734-
#ifdef WC_AES_C_DYNAMIC_FALLBACK
12735-
aes->use_aesni = 0;
12736-
xaes->tweak.use_aesni = 0;
12737-
#else
12738-
return ret;
12739-
#endif
12740-
}
1274112729
if (aes->use_aesni) {
12730+
SAVE_VECTOR_REGISTERS(return _svr_ret;);
1274212731
#if defined(HAVE_INTEL_AVX1)
1274312732
if (IS_INTEL_AVX1(intel_flags)) {
1274412733
AES_XTS_encrypt_avx1(in, out, sz, i,
@@ -12756,23 +12745,13 @@ int wc_AesXtsEncrypt(XtsAes* xaes, byte* out, const byte* in, word32 sz,
1275612745
(int)aes->rounds);
1275712746
ret = 0;
1275812747
}
12748+
RESTORE_VECTOR_REGISTERS();
1275912749
}
1276012750
else
1276112751
#endif
1276212752
{
1276312753
ret = AesXtsEncrypt_sw(xaes, out, in, sz, i);
1276412754
}
12765-
12766-
#ifdef WOLFSSL_AESNI
12767-
if (aes->use_aesni)
12768-
RESTORE_VECTOR_REGISTERS();
12769-
#ifdef WC_AES_C_DYNAMIC_FALLBACK
12770-
else if (orig_use_aesni) {
12771-
aes->use_aesni = orig_use_aesni;
12772-
xaes->tweak.use_aesni = orig_use_aesni;
12773-
}
12774-
#endif
12775-
#endif
1277612755
}
1277712756

1277812757
return ret;
@@ -12962,19 +12941,8 @@ int wc_AesXtsDecrypt(XtsAes* xaes, byte* out, const byte* in, word32 sz,
1296212941

1296312942
{
1296412943
#ifdef WOLFSSL_AESNI
12965-
#ifdef WC_AES_C_DYNAMIC_FALLBACK
12966-
int orig_use_aesni = aes->use_aesni;
12967-
#endif
12968-
12969-
if (aes->use_aesni && ((ret = SAVE_VECTOR_REGISTERS2() != 0))) {
12970-
#ifdef WC_AES_C_DYNAMIC_FALLBACK
12971-
aes->use_aesni = 0;
12972-
xaes->tweak.use_aesni = 0;
12973-
#else
12974-
return ret;
12975-
#endif
12976-
}
1297712944
if (aes->use_aesni) {
12945+
SAVE_VECTOR_REGISTERS(return _svr_ret;);
1297812946
#if defined(HAVE_INTEL_AVX1)
1297912947
if (IS_INTEL_AVX1(intel_flags)) {
1298012948
AES_XTS_decrypt_avx1(in, out, sz, i,
@@ -12992,24 +12960,14 @@ int wc_AesXtsDecrypt(XtsAes* xaes, byte* out, const byte* in, word32 sz,
1299212960
(int)aes->rounds);
1299312961
ret = 0;
1299412962
}
12963+
RESTORE_VECTOR_REGISTERS();
1299512964
}
1299612965
else
1299712966
#endif
1299812967
{
1299912968
ret = AesXtsDecrypt_sw(xaes, out, in, sz, i);
1300012969
}
1300112970

13002-
#ifdef WOLFSSL_AESNI
13003-
if (aes->use_aesni)
13004-
RESTORE_VECTOR_REGISTERS();
13005-
#ifdef WC_AES_C_DYNAMIC_FALLBACK
13006-
else if (orig_use_aesni) {
13007-
aes->use_aesni = orig_use_aesni;
13008-
xaes->tweak.use_aesni = orig_use_aesni;
13009-
}
13010-
#endif
13011-
#endif
13012-
1301312971
return ret;
1301412972
}
1301512973
}

‎wolfcrypt/src/fe_448.c‎

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1437,56 +1437,56 @@ void fe448_to_bytes(unsigned char* b, const sword32* a)
14371437
b[ 0] = (byte)(in0 >> 0);
14381438
b[ 1] = (byte)(in0 >> 8);
14391439
b[ 2] = (byte)(in0 >> 16);
1440-
b[ 3] = (byte)(in0 >> 24) + ((in1 >> 0) << 4);
1440+
b[ 3] = (byte)((in0 >> 24) + ((in1 >> 0) << 4));
14411441
b[ 4] = (byte)(in1 >> 4);
14421442
b[ 5] = (byte)(in1 >> 12);
14431443
b[ 6] = (byte)(in1 >> 20);
14441444
b[ 7] = (byte)(in2 >> 0);
14451445
b[ 8] = (byte)(in2 >> 8);
14461446
b[ 9] = (byte)(in2 >> 16);
1447-
b[10] = (byte)(in2 >> 24) + ((in3 >> 0) << 4);
1447+
b[10] = (byte)((in2 >> 24) + ((in3 >> 0) << 4));
14481448
b[11] = (byte)(in3 >> 4);
14491449
b[12] = (byte)(in3 >> 12);
14501450
b[13] = (byte)(in3 >> 20);
14511451
b[14] = (byte)(in4 >> 0);
14521452
b[15] = (byte)(in4 >> 8);
14531453
b[16] = (byte)(in4 >> 16);
1454-
b[17] = (byte)(in4 >> 24) + ((in5 >> 0) << 4);
1454+
b[17] = (byte)((in4 >> 24) + ((in5 >> 0) << 4));
14551455
b[18] = (byte)(in5 >> 4);
14561456
b[19] = (byte)(in5 >> 12);
14571457
b[20] = (byte)(in5 >> 20);
14581458
b[21] = (byte)(in6 >> 0);
14591459
b[22] = (byte)(in6 >> 8);
14601460
b[23] = (byte)(in6 >> 16);
1461-
b[24] = (byte)(in6 >> 24) + ((in7 >> 0) << 4);
1461+
b[24] = (byte)((in6 >> 24) + ((in7 >> 0) << 4));
14621462
b[25] = (byte)(in7 >> 4);
14631463
b[26] = (byte)(in7 >> 12);
14641464
b[27] = (byte)(in7 >> 20);
14651465
b[28] = (byte)(in8 >> 0);
14661466
b[29] = (byte)(in8 >> 8);
14671467
b[30] = (byte)(in8 >> 16);
1468-
b[31] = (byte)(in8 >> 24) + ((in9 >> 0) << 4);
1468+
b[31] = (byte)((in8 >> 24) + ((in9 >> 0) << 4));
14691469
b[32] = (byte)(in9 >> 4);
14701470
b[33] = (byte)(in9 >> 12);
14711471
b[34] = (byte)(in9 >> 20);
14721472
b[35] = (byte)(in10 >> 0);
14731473
b[36] = (byte)(in10 >> 8);
14741474
b[37] = (byte)(in10 >> 16);
1475-
b[38] = (byte)(in10 >> 24) + ((in11 >> 0) << 4);
1475+
b[38] = (byte)((in10 >> 24) + ((in11 >> 0) << 4));
14761476
b[39] = (byte)(in11 >> 4);
14771477
b[40] = (byte)(in11 >> 12);
14781478
b[41] = (byte)(in11 >> 20);
14791479
b[42] = (byte)(in12 >> 0);
14801480
b[43] = (byte)(in12 >> 8);
14811481
b[44] = (byte)(in12 >> 16);
1482-
b[45] = (byte)(in12 >> 24) + ((in13 >> 0) << 4);
1482+
b[45] = (byte)((in12 >> 24) + ((in13 >> 0) << 4));
14831483
b[46] = (byte)(in13 >> 4);
14841484
b[47] = (byte)(in13 >> 12);
14851485
b[48] = (byte)(in13 >> 20);
14861486
b[49] = (byte)(in14 >> 0);
14871487
b[50] = (byte)(in14 >> 8);
14881488
b[51] = (byte)(in14 >> 16);
1489-
b[52] = (byte)(in14 >> 24) + ((in15 >> 0) << 4);
1489+
b[52] = (byte)((in14 >> 24) + ((in15 >> 0) << 4));
14901490
b[53] = (byte)(in15 >> 4);
14911491
b[54] = (byte)(in15 >> 12);
14921492
b[55] = (byte)(in15 >> 20);
@@ -1834,6 +1834,7 @@ static WC_INLINE void fe448_mul_8(sword32* r, const sword32* a, const sword32* b
18341834
sword64 t13 = (sword64)a[ 6] * b[ 7];
18351835
sword64 t113 = (sword64)a[ 7] * b[ 6];
18361836
sword64 t14 = (sword64)a[ 7] * b[ 7];
1837+
sword64 o, t15;
18371838
t1 += t101;
18381839
t2 += t102; t2 += t202;
18391840
t3 += t103; t3 += t203; t3 += t303;
@@ -1850,8 +1851,8 @@ static WC_INLINE void fe448_mul_8(sword32* r, const sword32* a, const sword32* b
18501851
t11 += t111; t11 += t211; t11 += t311;
18511852
t12 += t112; t12 += t212;
18521853
t13 += t113;
1853-
sword64 o = t14 >> 28;
1854-
sword64 t15 = o;
1854+
o = t14 >> 28;
1855+
t15 = o;
18551856
t14 -= o << 28;
18561857
o = (t0 >> 28); t1 += o; t = o << 28; t0 -= t;
18571858
o = (t1 >> 28); t2 += o; t = o << 28; t1 -= t;

0 commit comments

Comments
 (0)