Skip to content

Commit bba9add

Browse files
author
gojimmypi
committed
Merge branch 'master' of https://github.com/wolfssl/wolfssl into windows-gettime_secs
2 parents e74b3ec + fc4e4f1 commit bba9add

46 files changed

Lines changed: 7681 additions & 1146 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/zephyr.yml‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,11 @@ on:
66
jobs:
77
run_test:
88
name: Build and run
9+
strategy:
10+
matrix:
11+
config:
12+
- zephyr-ref: v3.4.0
13+
zephyr-sdk: 0.16.1
914
runs-on: ubuntu-latest
1015
# This should be a safe limit for the tests to run.
1116
timeout-minutes: 15
@@ -33,7 +38,7 @@ jobs:
3338
run: sudo pip install west
3439

3540
- name: Init west workspace
36-
run: west init zephyr
41+
run: west init --mr ${{ matrix.config.zephyr-ref }} zephyr
3742

3843
- name: Update west.yml
3944
working-directory: zephyr/zephyr
@@ -56,9 +61,9 @@ jobs:
5661

5762
- name: Install zephyr SDK
5863
run: |
59-
wget -q https://github.com/zephyrproject-rtos/sdk-ng/releases/download/v0.16.1/zephyr-sdk-0.16.1_linux-x86_64.tar.xz
60-
tar xf zephyr-sdk-0.16.1_linux-x86_64.tar.xz
61-
cd zephyr-sdk-0.16.1
64+
wget -q https://github.com/zephyrproject-rtos/sdk-ng/releases/download/v${{ matrix.config.zephyr-sdk }}/zephyr-sdk-${{ matrix.config.zephyr-sdk }}_linux-x86_64.tar.xz
65+
tar xf zephyr-sdk-${{ matrix.config.zephyr-sdk }}_linux-x86_64.tar.xz
66+
cd zephyr-sdk-${{ matrix.config.zephyr-sdk }}
6267
./setup.sh -h -c
6368
6469
- name: Run wolfssl test

‎INSTALL‎

Lines changed: 14 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -264,20 +264,20 @@ We also have vcpkg ports for wolftpm, wolfmqtt and curl.
264264
branch of the hash-sigs project.
265265

266266
Currently the hash-sigs project only builds static libraries:
267+
- hss_verify.a: a single-threaded verify-only static lib.
267268
- hss_lib.a: a single-threaded static lib.
268269
- hss_lib_thread.a: a multi-threaded static lib.
269270

270271
The multi-threaded version will mainly have speedups for key
271272
generation and signing.
272273

273-
Additionally, the hash-sigs project can be modified to build
274-
and install a shared library in /usr/local with either single
275-
or multi-threaded versions. If the shared version has been
276-
built, libhss.so is the assumed name.
274+
The default LMS build (--enable-lms) will look for
275+
hss_lib.a first, and hss_lib_thread.a second, in a specified
276+
hash-sigs dir.
277277

278-
wolfSSL supports either option, and by default will look for
279-
hss_lib.a first, and hss_lib_thread.a second, and libhss.so
280-
lastly, in a specified hash-sigs dir.
278+
The LMS verify-only build (--enable-lms=verify-only) will look
279+
for hss_verify.a only, which is a slimmer library that includes
280+
only the minimal functions necessary for signature verification.
281281

282282
How to get and build the hash-sigs library:
283283
$ mkdir ~/hash_sigs
@@ -299,12 +299,17 @@ We also have vcpkg ports for wolftpm, wolfmqtt and curl.
299299
$ ls *.a
300300
hss_lib_thread.a
301301

302+
To build verify-only:
303+
$ make hss_verify.a
304+
$ ls *.a
305+
hss_verify.a
306+
302307
Build wolfSSL with
303308
$ ./configure \
304309
--enable-static \
305310
--disable-shared \
306-
--enable-lms=yes \
307-
--with-liblms=<path to dir containing hss_lib_thread.a>
311+
--enable-lms \
312+
--with-liblms=<path to dir containing hss_lib.a or hss_lib_thread.a>
308313
$ make
309314

310315
Run the benchmark against LMS/HSS with:

‎configure.ac‎

Lines changed: 65 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -1141,6 +1141,49 @@ then
11411141
fi
11421142

11431143

1144+
# LMS
1145+
AC_ARG_ENABLE([lms],
1146+
[AS_HELP_STRING([--enable-lms],[Enable stateful LMS/HSS signatures (default: disabled)])],
1147+
[ ENABLED_LMS=$enableval ],
1148+
[ ENABLED_LMS=no ]
1149+
)
1150+
1151+
ENABLED_WC_LMS=no
1152+
for v in `echo $ENABLED_LMS | tr "," " "`
1153+
do
1154+
case $v in
1155+
yes)
1156+
;;
1157+
no)
1158+
;;
1159+
verify-only)
1160+
LMS_VERIFY_ONLY=yes
1161+
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_LMS_VERIFY_ONLY"
1162+
;;
1163+
wolfssl)
1164+
ENABLED_WC_LMS=yes
1165+
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_WC_LMS"
1166+
;;
1167+
*)
1168+
AC_MSG_ERROR([Invalid choice for LMS []: $ENABLED_LMS.])
1169+
break;;
1170+
esac
1171+
done
1172+
1173+
if test "$ENABLED_LMS" != "no"
1174+
then
1175+
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_HAVE_LMS"
1176+
1177+
if test "$ENABLED_WC_LMS" = "no";
1178+
then
1179+
# Default is to use hash-sigs LMS lib. Make sure it's enabled.
1180+
if test "$ENABLED_LIBLMS" = "no"; then
1181+
AC_MSG_ERROR([The default implementation for LMS is the hash-sigs LMS/HSS lib.
1182+
Please use --with-liblms.])
1183+
fi
1184+
fi
1185+
fi
1186+
11441187
# liblms
11451188
# Get the path to the hash-sigs LMS HSS lib.
11461189
ENABLED_LIBLMS="no"
@@ -1160,10 +1203,21 @@ AC_ARG_WITH([liblms],
11601203
tryliblmsdir="/usr/local"
11611204
fi
11621205
1163-
# 1. By default use the hash-sigs single-threaded static library.
1164-
# 2. If 1 not found, then use the multi-threaded static lib.
1165-
# 3. If 2 not found, then use the multi-threaded dynamic lib.
1166-
if test -e $tryliblmsdir/hss_lib.a; then
1206+
# 1. If verify only build, use hss_verify.a
1207+
# 2. If normal build, by default use single-threaded hss_lib.a
1208+
# 3. If 2 not found, then use the multi-threaded hss_lib_thread.a
1209+
if test "$LMS_VERIFY_ONLY" = "yes"; then
1210+
if test -e $tryliblmsdir/hss_verify.a; then
1211+
CPPFLAGS="$AM_CPPFLAGS -DHAVE_LIBLMS -I$tryliblmsdir"
1212+
LIB_STATIC_ADD="$LIB_STATIC_ADD $tryliblmsdir/hss_verify.a"
1213+
enable_shared=no
1214+
enable_static=yes
1215+
liblms_linked=yes
1216+
else
1217+
AC_MSG_ERROR([hss_verify.a isn't found.
1218+
If it's already installed, specify its path using --with-liblms=/dir/])
1219+
fi
1220+
elif test -e $tryliblmsdir/hss_lib.a; then
11671221
CPPFLAGS="$AM_CPPFLAGS -DHAVE_LIBLMS -I$tryliblmsdir"
11681222
LIB_STATIC_ADD="$LIB_STATIC_ADD $tryliblmsdir/hss_lib.a"
11691223
enable_shared=no
@@ -1175,12 +1229,6 @@ AC_ARG_WITH([liblms],
11751229
enable_shared=no
11761230
enable_static=yes
11771231
liblms_linked=yes
1178-
elif test -e $tryliblmsdir/lib/libhss.so; then
1179-
LIBS="$LIBS -lhss"
1180-
CPPFLAGS="$AM_CPPFLAGS -DHAVE_LIBLMS -I$tryliblmsdir/include/hss"
1181-
LDFLAGS="$AM_LDFLAGS $LDFLAGS -L$tryliblmsdir/lib"
1182-
1183-
AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <hss.h>]], [[ param_set_t lm_type; param_set_t lm_ots_type; hss_get_public_key_len(4, &lm_type, &lm_ots_type); ]])], [ liblms_linked=yes ],[ liblms_linked=no ])
11841232
else
11851233
AC_MSG_ERROR([liblms isn't found.
11861234
If it's already installed, specify its path using --with-liblms=/dir/])
@@ -1203,47 +1251,6 @@ AC_ARG_WITH([liblms],
12031251
]
12041252
)
12051253

1206-
1207-
# LMS
1208-
AC_ARG_ENABLE([lms],
1209-
[AS_HELP_STRING([--enable-lms],[Enable stateful LMS/HSS signatures (default: disabled)])],
1210-
[ ENABLED_LMS=$enableval ],
1211-
[ ENABLED_LMS=no ]
1212-
)
1213-
1214-
ENABLED_WC_LMS=no
1215-
for v in `echo $ENABLED_LMS | tr "," " "`
1216-
do
1217-
case $v in
1218-
yes)
1219-
;;
1220-
no)
1221-
;;
1222-
wolfssl)
1223-
ENABLED_WC_LMS=yes
1224-
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_WC_LMS"
1225-
;;
1226-
*)
1227-
AC_MSG_ERROR([Invalid choice for LMS []: $ENABLED_LMS.])
1228-
break;;
1229-
esac
1230-
done
1231-
1232-
if test "$ENABLED_LMS" != "no"
1233-
then
1234-
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_HAVE_LMS"
1235-
1236-
if test "$ENABLED_WC_LMS" = "no";
1237-
then
1238-
# Default is to use hash-sigs LMS lib. Make sure it's enabled.
1239-
if test "$ENABLED_LIBLMS" = "no"; then
1240-
AC_MSG_ERROR([The default implementation for LMS is the hash-sigs LMS/HSS lib.
1241-
Please use --with-liblms.])
1242-
fi
1243-
fi
1244-
fi
1245-
1246-
12471254
# SINGLE THREADED
12481255
AC_ARG_ENABLE([singlethreaded],
12491256
[AS_HELP_STRING([--enable-singlethreaded],[Enable wolfSSL single threaded (default: disabled)])],
@@ -2268,7 +2275,7 @@ AC_ARG_ENABLE([aescbc],
22682275
if test "$ENABLED_AESCBC" = "no"
22692276
then
22702277
AM_CFLAGS="$AM_CFLAGS -DNO_AES_CBC"
2271-
AM_CCASFLAGS="$AM_CCASFLAGS -DHAVE_AES_CBC"
2278+
AM_CCASFLAGS="$AM_CCASFLAGS -DNO_AES_CBC"
22722279
fi
22732280

22742281
# AES-CBC length checks (checks that input lengths are multiples of block size)
@@ -2582,7 +2589,7 @@ then
25822589
AC_MSG_NOTICE([64bit ARMv8 found, setting mcpu to generic+crypto])
25832590
;;
25842591
armv7a*)
2585-
AM_CPPFLAGS="$AM_CPPFLAGS -march=armv7-a -mfpu=neon -DWOLFSSL_ARM_ARCH=7"
2592+
AM_CPPFLAGS="$AM_CPPFLAGS -march=armv7-a -mfpu=neon -DWOLFSSL_ARM_ARCH=7 -marm"
25862593
# Include options.h
25872594
AM_CCASFLAGS="$AM_CCASFLAGS -DEXTERNAL_OPTS_OPENVPN"
25882595
ENABLED_ARMASM_CRYPTO=no
@@ -5984,6 +5991,11 @@ then
59845991
ENABLED_CERTGEN="yes"
59855992
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CERT_GEN"
59865993
fi
5994+
if test "x$ENABLED_CERTREQ" = "xno"
5995+
then
5996+
ENABLED_CERTREQ="yes"
5997+
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CERT_REQ"
5998+
fi
59875999
if test "x$ENABLED_SNI" = "xno"
59886000
then
59896001
ENABLED_SNI="yes"

‎doc/dox_comments/header_files-ja/asn_public.h‎

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -393,7 +393,7 @@ int wc_GetSubjectRaw(byte **subjectRaw, Cert *cert);
393393
\return ASN_NO_SIGNER_E CA証明書の主体者を検証することができない場合に返されます。
394394
395395
\param cert 主体者の別名を設定する対象のCert構造体へのポインタ
396-
\param file PEM形式の証明書を格納しているバッファへのポインタ。
396+
\param file PEM形式の証明書のファイルパス
397397
398398
_Example_
399399
\code
@@ -901,7 +901,7 @@ int wc_PubKeyPemToDer(const unsigned char* pem, int pemSz,
901901
\return MEMORY_E メモリの確保に失敗した際に返されます。
902902
903903
\param fileName PEM形式のファイルパス
904-
\param derBuf DER形式証明書を出力する先のバッファ
904+
\param derBuf DER形式証明書を出力する先のバッファへのポインタ
905905
\param derSz DER形式証明書を出力する先のバッファのサイズ
906906
907907
_Example_
@@ -1127,7 +1127,7 @@ int wc_EccPrivateKeyDecode(const byte* input, word32* inOutIdx,
11271127
/*!
11281128
\ingroup ASN
11291129
1130-
\brief この関数はECC秘密鍵をDER形式で出力します。
1130+
\brief この関数はECC秘密鍵をDER形式でバッファに出力します。
11311131
11321132
\return ECC秘密鍵をDER形式での出力に成功した場合にはバッファへ出力したサイズを返します。
11331133
\return BAD_FUNC_ARG 出力バッファoutputがNULLあるいはinLenがゼロの場合に返します。
@@ -1201,7 +1201,7 @@ int wc_EccPublicKeyDecode(const byte* input, word32* inOutIdx,
12011201
処理したバッファのサイズを返します。変換して得られるDER形式のECC公開鍵は出力バッファに格納されます。
12021202
AlgCurveフラグの指定により、アルゴリズムと曲線情報をヘッダーに含めることができます。
12031203
1204-
\return >0 成功時には処理したバッファのサイズを返します。
1204+
\return 成功時には処理したバッファのサイズを返します。
12051205
\return BAD_FUNC_ARG 出力バッファoutputあるいはecc_key構造体keyがNULLの場合に返します。
12061206
\return LENGTH_ONLY_E ECC公開鍵のサイズ取得に失敗した場合に返します。
12071207
\return BUFFER_E 出力バッファが必要量より小さい場合に返します。
@@ -1496,7 +1496,7 @@ int wc_EncryptPKCS8Key(byte* key, word32 keySz, byte* out,
14961496
/*!
14971497
\ingroup ASN
14981498
1499-
\brief この関数は暗号化されたPKCS#8のDER形式の鍵を受け取り、復号してPKCS#8 非暗号化DER形式に変換します。
1499+
\brief この関数は暗号化されたPKCS#8のDER形式の鍵を受け取り、復号してPKCS#8 DER形式に変換します。
15001500
wc_EncryptPKCS8Keyによって行われた暗号化を元に戻します。RFC5208を参照してください。
15011501
入力データは復号データによって上書きされます。
15021502
@@ -1794,11 +1794,11 @@ int wc_SetCustomExtension(Cert *cert, int critical, const char *oid,
17941794
// failed to set the callback
17951795
}
17961796
1797-
// oid: Array of integers that are the dot separated values in an oid.
1798-
// oidSz: Number of values in oid.
1799-
// crit: Whether the extension was mark critical.
1800-
// der: The der encoding of the content of the extension.
1801-
// derSz: The size in bytes of the der encoding.
1797+
// oid: OIDを構成するドット区切りの数を格納した配列
1798+
// oidSz: oid内の値の数
1799+
// crit: 拡張がクリティカルとマークされているか
1800+
// der: DERエンコードされている拡張の内容
1801+
// derSz: 拡張の内容のサイズ
18021802
int myCustomExtCallback(const word16* oid, word32 oidSz, int crit,
18031803
const unsigned char* der, word32 derSz) {
18041804
@@ -1808,6 +1808,8 @@ int wc_SetCustomExtension(Cert *cert, int critical, const char *oid,
18081808
// 表明することになります。この拡張を処理できると判断できない場合にはエラーを
18091809
// 返してください。クリティカルとマークされている未知の拡張に遭遇した際の標準的
18101810
// な振る舞いはASN_CRIT_EXT_Eを返すことです。
1811+
// 簡潔にするためにこの例ではすべての拡張情報を受け入れ可としていますが、実際には実情に沿うようにロジックを追加してください。
1812+
18111813
return 0;
18121814
}
18131815
\endcode

‎fips-check.sh‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -168,6 +168,7 @@ linuxv5)
168168
'wolfssl/wolfcrypt/cmac.h:WCv5.0-RC12'
169169
'wolfssl/wolfcrypt/dh.h:WCv5.0-RC12'
170170
'wolfssl/wolfcrypt/ecc.h:WCv5.0-RC12'
171+
'wolfssl/wolfcrypt/fips_test.h:WCv5.0-RC12'
171172
'wolfssl/wolfcrypt/hmac.h:WCv5.0-RC12'
172173
'wolfssl/wolfcrypt/kdf.h:WCv5.0-RC12'
173174
'wolfssl/wolfcrypt/random.h:WCv5.0-RC12'
@@ -178,6 +179,48 @@ linuxv5)
178179
'wolfssl/wolfcrypt/sha512.h:WCv5.0-RC12'
179180
)
180181
;;
182+
linuxv5.2.1)
183+
FIPS_OPTION='v5'
184+
FIPS_FILES=(
185+
'wolfcrypt/src/fips.c:v5.2.1-stable'
186+
'wolfcrypt/src/fips_test.c:v5.2.1-stable'
187+
'wolfcrypt/src/wolfcrypt_first.c:v5.2.1-stable'
188+
'wolfcrypt/src/wolfcrypt_last.c:v5.2.1-stable'
189+
'wolfssl/wolfcrypt/fips.h:v5.2.1-stable'
190+
)
191+
WOLFCRYPT_FILES=(
192+
'wolfcrypt/src/aes.c:v5.2.1-stable'
193+
'wolfcrypt/src/aes_asm.asm:v5.2.1-stable'
194+
'wolfcrypt/src/aes_asm.S:v5.2.1-stable'
195+
'wolfcrypt/src/aes_gcm_asm.S:v5.2.1-stable'
196+
'wolfcrypt/src/cmac.c:v5.2.1-stable'
197+
'wolfcrypt/src/dh.c:v5.2.1-stable'
198+
'wolfcrypt/src/ecc.c:v5.2.1-stable'
199+
'wolfcrypt/src/hmac.c:v5.2.1-stable'
200+
'wolfcrypt/src/kdf.c:v5.2.1-stable'
201+
'wolfcrypt/src/random.c:v5.2.1-stable'
202+
'wolfcrypt/src/rsa.c:v5.2.1-stable'
203+
'wolfcrypt/src/sha.c:v5.2.1-stable'
204+
'wolfcrypt/src/sha256.c:v5.2.1-stable'
205+
'wolfcrypt/src/sha256_asm.S:v5.2.1-stable'
206+
'wolfcrypt/src/sha3.c:v5.2.1-stable'
207+
'wolfcrypt/src/sha512.c:v5.2.1-stable'
208+
'wolfcrypt/src/sha512_asm.S:v5.2.1-stable'
209+
'wolfssl/wolfcrypt/aes.h:v5.2.1-stable'
210+
'wolfssl/wolfcrypt/cmac.h:v5.2.1-stable'
211+
'wolfssl/wolfcrypt/dh.h:v5.2.1-stable'
212+
'wolfssl/wolfcrypt/ecc.h:v5.2.1-stable'
213+
'wolfssl/wolfcrypt/fips_test.h:v5.2.1-stable'
214+
'wolfssl/wolfcrypt/hmac.h:v5.2.1-stable'
215+
'wolfssl/wolfcrypt/kdf.h:v5.2.1-stable'
216+
'wolfssl/wolfcrypt/random.h:v5.2.1-stable'
217+
'wolfssl/wolfcrypt/rsa.h:v5.2.1-stable'
218+
'wolfssl/wolfcrypt/sha.h:v5.2.1-stable'
219+
'wolfssl/wolfcrypt/sha256.h:v5.2.1-stable'
220+
'wolfssl/wolfcrypt/sha3.h:v5.2.1-stable'
221+
'wolfssl/wolfcrypt/sha512.h:v5.2.1-stable'
222+
)
223+
;;
181224
fips-ready|fips-dev)
182225
FIPS_OPTION='ready'
183226
FIPS_FILES=(

0 commit comments

Comments
 (0)