Skip to content

Commit d2afe9e

Browse files
SparkiDevSparkiDev
committed
Memory usage improvements
ECC: make private key field 'k' able to be smaller when ALT_ECC_SIZE is defined. WOLFSSL_SMALL_STACK_CACHE: allocate temps using new macros.
1 parent 6369b1e commit d2afe9e

18 files changed

Lines changed: 495 additions & 198 deletions

File tree

‎configure.ac‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7682,6 +7682,11 @@ case $host_cpu in
76827682
;;
76837683
esac
76847684

7685+
if test "$ENABLED_LOWRESOURCE" = "yes" && test "$ENABLED_ECC" = "yes" && (test "$ENABLED_RSA" = "yes" || test "$ENABLED_DH" == "yes") && (test "$ENABLED_SP_MATH" = "yes" || test "$ENABLED_SP_MATH_ALL" = "yes")
7686+
then
7687+
AM_CFLAGS="$AM_CFLAGS -DALT_ECC_SIZE"
7688+
fi
7689+
76857690
################################################################################
76867691
# Update ENABLE_* variables #
76877692
################################################################################

‎examples/client/client.c‎

Lines changed: 28 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1260,10 +1260,14 @@ static const char* client_usage_msg[][70] = {
12601260
#endif
12611261
#ifdef HAVE_SUPPORTED_CURVES
12621262
"--onlyPskDheKe Must use DHE key exchange with PSK\n", /* 73 */
1263+
#endif
1264+
#ifndef NO_PSK
1265+
"--openssl-psk Use TLS 1.3 PSK callback compatible with "
1266+
"OpenSSL\n", /* 74 */
12631267
#endif
12641268
"\n"
12651269
"For simpler wolfSSL TLS client examples, visit\n"
1266-
"https://github.com/wolfSSL/wolfssl-examples/tree/master/tls\n", /* 74 */
1270+
"https://github.com/wolfSSL/wolfssl-examples/tree/master/tls\n", /* 75 */
12671271
NULL,
12681272
},
12691273
#ifndef NO_MULTIBYTE_PRINT
@@ -1481,11 +1485,15 @@ static const char* client_usage_msg[][70] = {
14811485
#endif
14821486
#ifdef HAVE_SUPPORTED_CURVES
14831487
"--onlyPskDheKe Must use DHE key exchange with PSK\n", /* 73 */
1488+
#endif
1489+
#ifndef NO_PSK
1490+
"--openssl-psk Use TLS 1.3 PSK callback compatible with "
1491+
"OpenSSL\n", /* 74 */
14841492
#endif
14851493
"\n"
14861494
"より簡単なwolfSSL TSL クライアントの例については"
14871495
"下記にアクセスしてください\n"
1488-
"https://github.com/wolfSSL/wolfssl-examples/tree/master/tls\n", /* 74 */
1496+
"https://github.com/wolfSSL/wolfssl-examples/tree/master/tls\n", /* 75 */
14891497
NULL,
14901498
},
14911499
#endif
@@ -1852,13 +1860,17 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args)
18521860
#endif
18531861
#ifdef HAVE_SUPPORTED_CURVES
18541862
{ "onlyPskDheKe", 0, 264 },
1863+
#endif
1864+
#ifndef NO_PSK
1865+
{ "openssl-psk", 0, 265 },
18551866
#endif
18561867
{ 0, 0, 0 }
18571868
};
18581869
#endif
18591870
int version = CLIENT_INVALID_VERSION;
18601871
int minVersion = CLIENT_INVALID_VERSION;
18611872
int usePsk = 0;
1873+
int opensslPsk = 0;
18621874
int useAnon = 0;
18631875
int sendGET = 0;
18641876
int benchmark = 0;
@@ -2066,6 +2078,7 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args)
20662078
(void)loadCertKeyIntoSSLObj;
20672079
(void)usePqc;
20682080
(void)pqcAlg;
2081+
(void)opensslPsk;
20692082
StackTrap();
20702083

20712084
/* Reinitialize the global myVerifyAction. */
@@ -2678,6 +2691,11 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args)
26782691
#ifdef WOLFSSL_TLS13
26792692
onlyPskDheKe = 1;
26802693
#endif
2694+
#endif
2695+
break;
2696+
case 265:
2697+
#ifndef NO_PSK
2698+
opensslPsk = 1;
26812699
#endif
26822700
break;
26832701
default:
@@ -3060,10 +3078,15 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args)
30603078
wolfSSL_CTX_set_psk_client_callback(ctx, my_psk_client_cb);
30613079
#ifdef WOLFSSL_TLS13
30623080
#if !defined(WOLFSSL_PSK_TLS13_CB) && !defined(WOLFSSL_PSK_ONE_ID)
3063-
wolfSSL_CTX_set_psk_client_cs_callback(ctx, my_psk_client_cs_cb);
3064-
#else
3065-
wolfSSL_CTX_set_psk_client_tls13_callback(ctx, my_psk_client_tls13_cb);
3081+
if (!opensslPsk) {
3082+
wolfSSL_CTX_set_psk_client_cs_callback(ctx, my_psk_client_cs_cb);
3083+
}
3084+
else
30663085
#endif
3086+
{
3087+
wolfSSL_CTX_set_psk_client_tls13_callback(ctx,
3088+
my_psk_client_tls13_cb);
3089+
}
30673090
#endif
30683091
if (defaultCipherList == NULL) {
30693092
#if defined(HAVE_AESGCM) && !defined(NO_DH)

‎scripts/openssl.test‎

Lines changed: 50 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#!/bin/bash
22

3-
#openssl.test
3+
# openssl.test
44

55
# Enviornment variables used:
66
# OPENSSL (openssl app to use)
@@ -409,6 +409,14 @@ OIFS=$IFS # store old separator to reset
409409
#
410410
# Start
411411
#
412+
echo
413+
echo "wolfSSL configuration:"
414+
./config.status --config
415+
echo
416+
echo "OpenSSL version:"
417+
$OPENSSL version -a
418+
echo
419+
412420
ps -p $PPID >/dev/null 2>&1
413421
if [ "$?" = "1" ]
414422
then
@@ -494,51 +502,86 @@ esac
494502

495503
if [ "$wolf_certs" != "" ]
496504
then
505+
echo
506+
# Check if RSA certificates supported in wolfSSL
507+
wolf_rsa=`$WOLFSSL_CLIENT -A "${CERT_DIR}/ca-cert.pem" 2>&1`
508+
case $wolf_rsa in
509+
*"ca file"*)
510+
echo "wolfSSL does not support RSA"
511+
wolf_rsa=""
512+
;;
513+
*)
514+
;;
515+
esac
516+
if [ "$wolf_rsa" != "" ]; then
517+
echo "wolfSSL supports RSA"
518+
fi
497519
# Check if ECC certificates supported in wolfSSL
498-
wolf_ecc=`$WOLFSSL_CLIENT -A "${CERT_DIR}/ed25519/ca-ecc-cert.pem" 2>&1`
520+
wolf_ecc=`$WOLFSSL_CLIENT -A "${CERT_DIR}/ca-ecc-cert.pem" 2>&1`
499521
case $wolf_ecc in
500522
*"ca file"*)
523+
echo "wolfSSL does not support ECDSA"
501524
wolf_ecc=""
502525
;;
503526
*)
504527
;;
505528
esac
529+
if [ "$wolf_ecc" != "" ]; then
530+
echo "wolfSSL supports ECDSA"
531+
fi
506532
# Check if Ed25519 certificates supported in wolfSSL
507533
wolf_ed25519=`$WOLFSSL_CLIENT -A "${CERT_DIR}/ed25519/root-ed25519.pem" 2>&1`
508534
case $wolf_ed25519 in
509535
*"ca file"*)
536+
echo "wolfSSL does not support Ed25519"
510537
wolf_ed25519=""
511538
;;
512539
*)
513540
;;
514541
esac
542+
if [ "$wolf_ed25519" != "" ]; then
543+
echo "wolfSSL supports Ed25519"
544+
fi
515545
# Check if Ed25519 certificates supported in OpenSSL
516546
openssl_ed25519=`$OPENSSL s_client -cert "${CERT_DIR}/ed25519/client-ed25519.pem" -key "${CERT_DIR}/ed25519/client-ed25519-priv.pem" 2>&1`
517547
case $openssl_ed25519 in
518548
*"unable to load"*)
549+
echo "OpenSSL does not support Ed25519"
519550
wolf_ed25519=""
520551
;;
521552
*)
522553
;;
523554
esac
555+
if [ "$wolf_ed25519" != "" ]; then
556+
echo "OpenSSL supports Ed25519"
557+
fi
524558
# Check if Ed448 certificates supported in wolfSSL
525559
wolf_ed448=`$WOLFSSL_CLIENT -A "${CERT_DIR}/ed448/root-ed448.pem" 2>&1`
526560
case $wolf_ed448 in
527561
*"ca file"*)
562+
echo "wolfSSL does not support Ed448"
528563
wolf_ed448=""
529564
;;
530565
*)
531566
;;
532567
esac
568+
if [ "$wolf_ed448" != "" ]; then
569+
echo "wolfSSL supports Ed448"
570+
fi
533571
# Check if Ed448 certificates supported in OpenSSL
534572
openssl_ed448=`$OPENSSL s_client -cert "${CERT_DIR}/ed448/client-ed448.pem" -key "${CERT_DIR}/ed448/client-ed448-priv.pem" 2>&1`
535573
case $openssl_ed448 in
536574
*"unable to load"*)
575+
echo "OpenSSL does not support Ed448"
537576
wolf_ed448=""
538577
;;
539578
*)
540579
;;
541580
esac
581+
if [ "$wolf_ed448" != "" ]; then
582+
echo "OpenSSL supports Ed448"
583+
fi
584+
echo
542585
fi
543586

544587
openssl_tls13=`$OPENSSL s_client -help 2>&1`
@@ -664,7 +707,7 @@ if [ "$wolf_ecdsa" != "" -a "$wolf_ecc" != "" ]
664707
then
665708
cert_file="${CERT_DIR}/server-ecc.pem"
666709
key_file="${CERT_DIR}/ecc-key.pem"
667-
ca_file="${CERT_DIR}/client-ca.pem"
710+
ca_file="${CERT_DIR}/client-ecc-cert.pem"
668711

669712
openssl_suite="ECDH[E]-ECDSA"
670713
start_openssl_server
@@ -727,7 +770,7 @@ then
727770
tls13_psk_openssl_port=$server_port
728771
tls13_psk_openssl_pid=$server_pid
729772

730-
psk="-s"
773+
psk="-s --openssl-psk"
731774
wolfssl_suite="TLSv1.3_PSK"
732775
start_wolfssl_server
733776
tls13_psk_wolfssl_port=$server_port
@@ -977,8 +1020,8 @@ do
9771020
*ECDHE-ECDSA*|*ECDH-ECDSA*)
9781021
if [ "$wolf_ecc" != "" ]
9791022
then
980-
cert="${CERT_DIR}/client-cert.pem"
981-
key="${CERT_DIR}/client-key.pem"
1023+
cert="${CERT_DIR}/client-ecc-cert.pem"
1024+
key="${CERT_DIR}/ecc-client-key.pem"
9821025
caCert="${CERT_DIR}/ca-ecc-cert.pem"
9831026

9841027
port=$ecdsa_openssl_port
@@ -1090,7 +1133,7 @@ do
10901133

10911134
wolf_temp_cases_total=$((wolf_temp_cases_total + 1))
10921135
port=$tls13_psk_openssl_port
1093-
psk="-s"
1136+
psk="-s --openssl-psk"
10941137
# OpenSSL doesn't support DH for key exchange so do no PSK
10951138
# DHE when ECC not supported
10961139
if [ "$wolf_ecc" = "" ]

‎src/internal.c‎

Lines changed: 39 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -25415,6 +25415,29 @@ int PickHashSigAlgo(WOLFSSL* ssl, const byte* hashSigAlgo, word32 hashSigAlgoSz)
2541525415
if (ret == 0 && hashAlgo > ssl->options.hashAlgo)
2541625416
break;
2541725417
#endif
25418+
if (IsAtLeastTLSv1_2(ssl) && !IsAtLeastTLSv1_3(ssl->version) &&
25419+
(ssl->options.side == WOLFSSL_CLIENT_END)) {
25420+
/* TLS 1.2 client deciding hash algorithm for
25421+
* CertificateVerify. Hash must be one of the handshake
25422+
* hashes being maintained. */
25423+
if (1
25424+
#ifndef NO_SHA
25425+
&& (hashAlgo != sha_mac)
25426+
#endif
25427+
#ifndef NO_SHA256
25428+
&& (hashAlgo != sha256_mac)
25429+
#endif
25430+
#ifdef WOLFSSL_SHA384
25431+
&& (hashAlgo != sha384_mac)
25432+
#endif
25433+
#ifdef WOLFSSL_SHA512
25434+
&& (hashAlgo != sha512_mac)
25435+
#endif
25436+
)
25437+
{
25438+
break;
25439+
}
25440+
}
2541825441
/* The chosen one - but keep looking. */
2541925442
ssl->options.hashAlgo = hashAlgo;
2542025443
ssl->options.sigAlgo = sigAlgo;
@@ -30188,17 +30211,22 @@ int SendCertificateVerify(WOLFSSL* ssl)
3018830211
}
3018930212
#endif
3019030213

30191-
#ifndef NO_OLD_TLS
30192-
#ifndef NO_SHA
30193-
/* old tls default */
30194-
SetDigest(ssl, sha_mac);
30195-
#endif
30196-
#else
30197-
#ifndef NO_SHA256
30198-
/* new tls default */
30199-
SetDigest(ssl, sha256_mac);
30200-
#endif
30201-
#endif /* !NO_OLD_TLS */
30214+
if (!IsAtLeastTLSv1_2(ssl)) {
30215+
#ifndef NO_OLD_TLS
30216+
#ifndef NO_SHA
30217+
/* old tls default */
30218+
SetDigest(ssl, sha_mac);
30219+
#endif
30220+
#else
30221+
#ifndef NO_SHA256
30222+
/* new tls default */
30223+
SetDigest(ssl, sha256_mac);
30224+
#endif
30225+
#endif /* !NO_OLD_TLS */
30226+
}
30227+
else {
30228+
SetDigest(ssl, ssl->options.hashAlgo);
30229+
}
3020230230

3020330231
if (ssl->hsType == DYNAMIC_TYPE_RSA) {
3020430232
#ifdef WC_RSA_PSS

‎src/pk.c‎

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,15 @@
3030
#include <wolfssl/wolfcrypt/random.h>
3131
#endif
3232

33+
#ifdef HAVE_ECC
34+
#include <wolfssl/wolfcrypt/ecc.h>
35+
#endif
36+
#ifndef WOLFSSL_HAVE_ECC_KEY_GET_PRIV
37+
/* FIPS build has replaced ecc.h. */
38+
#define wc_ecc_key_get_priv(key) (&((key)->k))
39+
#define WOLFSSL_HAVE_ECC_KEY_GET_PRIV
40+
#endif
41+
3342
#if !defined(WOLFSSL_PK_INCLUDED)
3443
#ifndef WOLFSSL_IGNORE_FILE_WARN
3544
#warning pk.c does not need to be compiled separately from ssl.c
@@ -11395,7 +11404,7 @@ static int wolfssl_ec_key_int_copy(ecc_key* dst, const ecc_key* src)
1139511404

1139611405
if (ret == 0) {
1139711406
/* Copy private key. */
11398-
ret = mp_copy(&src->k, &dst->k);
11407+
ret = mp_copy(wc_ecc_key_get_priv(src), wc_ecc_key_get_priv(dst));
1139911408
if (ret != MP_OKAY) {
1140011409
WOLFSSL_MSG("mp_copy error");
1140111410
}
@@ -12533,7 +12542,8 @@ int SetECKeyExternal(WOLFSSL_EC_KEY* eckey)
1253312542

1253412543
/* set the external privkey */
1253512544
if ((ret == 1) && (key->type == ECC_PRIVATEKEY) &&
12536-
(wolfssl_bn_set_value(&eckey->priv_key, &key->k) != 1)) {
12545+
(wolfssl_bn_set_value(&eckey->priv_key,
12546+
wc_ecc_key_get_priv(key)) != 1)) {
1253712547
WOLFSSL_MSG("ec priv key error");
1253812548
ret = -1;
1253912549
}
@@ -12604,12 +12614,13 @@ int SetECKeyInternal(WOLFSSL_EC_KEY* eckey)
1260412614

1260512615
/* set privkey */
1260612616
if ((ret == 1) && (eckey->priv_key != NULL)) {
12607-
if (wolfssl_bn_get_value(eckey->priv_key, &key->k) != 1) {
12617+
if (wolfssl_bn_get_value(eckey->priv_key,
12618+
wc_ecc_key_get_priv(key)) != 1) {
1260812619
WOLFSSL_MSG("ec key priv error");
1260912620
ret = -1;
1261012621
}
1261112622
/* private key */
12612-
if ((ret == 1) && (!mp_iszero(&key->k))) {
12623+
if ((ret == 1) && (!mp_iszero(wc_ecc_key_get_priv(key)))) {
1261312624
if (pubSet) {
1261412625
key->type = ECC_PRIVATEKEY;
1261512626
}

0 commit comments

Comments
 (0)