From 83b146f858ac1f79b1be95b42cfafc249b10534b Mon Sep 17 00:00:00 2001 From: CN_SZTL Date: Fri, 8 Nov 2019 21:06:36 +0800 Subject: [PATCH] wolfssl: update to v4.2.0-stable --- package/libs/wolfssl/Config.in | 54 +- package/libs/wolfssl/Makefile | 130 +--- ...nstant-time-when-Block-Type-2-messag.patch | 562 ------------------ .../020-Improve-nonce-use-in-ECC-mulmod.patch | 98 --- .../patches/100-disable-hardening-check.patch | 4 +- .../400-additional_compatibility.patch | 12 - .../900-remove-broken-autoconf-macros.patch | 21 - 7 files changed, 70 insertions(+), 811 deletions(-) delete mode 100644 package/libs/wolfssl/patches/010-Make-RsaUnPad-constant-time-when-Block-Type-2-messag.patch delete mode 100644 package/libs/wolfssl/patches/020-Improve-nonce-use-in-ECC-mulmod.patch delete mode 100644 package/libs/wolfssl/patches/400-additional_compatibility.patch delete mode 100644 package/libs/wolfssl/patches/900-remove-broken-autoconf-macros.patch diff --git a/package/libs/wolfssl/Config.in b/package/libs/wolfssl/Config.in index 50b0bb9cdf..4ac69f821a 100644 --- a/package/libs/wolfssl/Config.in +++ b/package/libs/wolfssl/Config.in @@ -4,16 +4,8 @@ config WOLFSSL_HAS_AES_CCM bool "Include AES-CCM support" default y -config WOLFSSL_HAS_AES_GCM - bool "Include AES-GCM support" - default y - -config WOLFSSL_HAS_CHACHA - bool "Include ChaCha cipher suite support" - default n - -config WOLFSSL_HAS_ECC - bool "Include ECC (Elliptic Curve Cryptography) support" +config WOLFSSL_HAS_CHACHA_POLY + bool "Include ChaCha20-Poly1305 cipher suite support" default y config WOLFSSL_HAS_DH @@ -24,12 +16,12 @@ config WOLFSSL_HAS_ARC4 bool "Include ARC4 support" default y -config WOLFSSL_HAS_DES3 - bool "Include DES3 (Tripple-DES) support" +config WOLFSSL_HAS_TLSV10 + bool "Include TLS 1.0 support" default y -config WOLFSSL_HAS_PSK - bool "Include PKS (Pre Share Key) support" +config WOLFSSL_HAS_TLSV13 + bool "Include TLS 1.3 support" default y config WOLFSSL_HAS_SESSION_TICKET @@ -41,20 +33,44 @@ config WOLFSSL_HAS_DTLS default n config WOLFSSL_HAS_OCSP - bool "Include OSCP support" + bool "Include OSCP stapling support" default y config WOLFSSL_HAS_WPAS bool "Include wpa_supplicant support" + select WOLFSSL_HAS_ARC4 + select WOLFSSL_HAS_OCSP + select WOLFSSL_HAS_SESSION_TICKET default y config WOLFSSL_HAS_ECC25519 bool "Include ECC Curve 22519 support" - depends on WOLFSSL_HAS_ECC default n -config WOLFSSL_HAS_POLY_1305 - bool "Include Poly-1305 support" - default n +config WOLFSSL_HAS_DEVCRYPTO + bool + +choice + prompt "Hardware Acceleration" + default WOLFSSL_HAS_NO_HW + + config WOLFSSL_HAS_NO_HW + bool "None" + + config WOLFSSL_HAS_AFALG + bool "AF_ALG" + + config WOLFSSL_HAS_DEVCRYPTO_CBC + bool "/dev/crytpo - AES-CBC-only" + select WOLFSSL_HAS_DEVCRYPTO + + config WOLFSSL_HAS_DEVCRYPTO_AES + bool "/dev/crypto - AES-only (all supported modes)" + select WOLFSSL_HAS_DEVCRYPTO + + config WOLFSSL_HAS_DEVCRYPTO_FULL + bool "/dev/crypto - full" + select WOLFSSL_HAS_DEVCRYPTO +endchoice endif diff --git a/package/libs/wolfssl/Makefile b/package/libs/wolfssl/Makefile index 6f29cd668d..3d2a56a97f 100644 --- a/package/libs/wolfssl/Makefile +++ b/package/libs/wolfssl/Makefile @@ -8,30 +8,30 @@ include $(TOPDIR)/rules.mk PKG_NAME:=wolfssl -PKG_VERSION:=3.15.3-stable -PKG_RELEASE:=2 +PKG_VERSION:=4.2.0-stable +PKG_RELEASE:=1 -PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).zip -# PKG_SOURCE_URL:=https://www.wolfssl.com/ +PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz PKG_SOURCE_URL:=https://github.com/wolfSSL/wolfssl/archive/v$(PKG_VERSION) -PKG_HASH:=dc97c07a7667b39a890e14f4b4a209f51524a4cabee7adb6c80822ee78c1f62a +PKG_HASH:=3562af485c26cd7abe94d9404fbfc0c5c9bceb4aab29b81ebf5e6c2467507e12 PKG_FIXUP:=libtool PKG_INSTALL:=1 PKG_USE_MIPS16:=0 PKG_BUILD_PARALLEL:=1 -PKG_LICENSE:=GPL-2.0+ +PKG_LICENSE:=GPL-2.0-or-later +PKG_LICENSE_FILES:=LICENSING COPYING PKG_MAINTAINER:=Eneas U de Queiroz PKG_CPE_ID:=cpe:/a:wolfssl:wolfssl PKG_CONFIG_DEPENDS:=\ - CONFIG_WOLFSSL_HAS_AES_CCM CONFIG_WOLFSSL_HAS_AES_GCM \ - CONFIG_WOLFSSL_HAS_ARC4 CONFIG_WOLFSSL_HAS_CHACHA \ - CONFIG_WOLFSSL_HAS_DES3 CONFIG_WOLFSSL_HAS_DH CONFIG_WOLFSSL_HAS_DTLS \ - CONFIG_WOLFSSL_HAS_ECC CONFIG_WOLFSSL_HAS_ECC25519 \ - CONFIG_WOLFSSL_HAS_OCSP CONFIG_WOLFSSL_HAS_POLY_1305 \ - CONFIG_WOLFSSL_HAS_PSK CONFIG_WOLFSSL_HAS_SESSION_TICKET \ - CONFIG_WOLFSSL_HAS_WPAS + CONFIG_WOLFSSL_HAS_AES_CCM CONFIG_WOLFSSL_HAS_AFALG \ + CONFIG_WOLFSSL_HAS_ARC4 CONFIG_WOLFSSL_HAS_CHACHA_POLY \ + CONFIG_WOLFSSL_HAS_DEVCRYPTO_AES CONFIG_WOLFSSL_HAS_DEVCRYPTO_FULL \ + CONFIG_WOLFSSL_HAS_DH CONFIG_WOLFSSL_HAS_DTLS \ + CONFIG_WOLFSSL_HAS_ECC25519 CONFIG_WOLFSSL_HAS_OCSP \ + CONFIG_WOLFSSL_HAS_SESSION_TICKET CONFIG_WOLFSSL_HAS_TLSV10 \ + CONFIG_WOLFSSL_HAS_TLSV13 CONFIG_WOLFSSL_HAS_WPAS include $(INCLUDE_DIR)/package.mk @@ -43,6 +43,8 @@ define Package/libwolfssl URL:=http://www.wolfssl.com/ MENU:=1 PROVIDES:=libcyassl + DEPENDS:=+WOLFSSL_HAS_DEVCRYPTO:kmod-cryptodev +WOLFSSL_HAS_AFALG:kmod-crypto-user + ABI_VERSION:=23 endef define Package/libwolfssl/description @@ -54,7 +56,7 @@ define Package/libwolfssl/config source "$(SOURCE)/Config.in" endef -TARGET_CFLAGS += $(FPIC) +TARGET_CFLAGS += $(FPIC) -DFP_MAX_BITS=8192 # --enable-stunnel needed for OpenSSL API compatibility bits CONFIGURE_ARGS += \ @@ -62,70 +64,22 @@ CONFIGURE_ARGS += \ --enable-sni \ --enable-stunnel \ --disable-examples \ - --disable-leanpsk \ - --disable-leantls \ - -ifeq ($(CONFIG_IPV6),y) -CONFIGURE_ARGS += \ - --enable-ipv6 -endif - -ifeq ($(CONFIG_WOLFSSL_HAS_AES_CCM),y) -CONFIGURE_ARGS += \ - --enable-aesccm -endif - -ifneq ($(CONFIG_WOLFSSL_HAS_AES_GCM),y) -CONFIGURE_ARGS += \ - --disable-aesgcm -endif - -ifneq ($(CONFIG_WOLFSSL_HAS_CHACHA),y) -CONFIGURE_ARGS += \ - --disable-chacha -endif - -ifeq ($(CONFIG_WOLFSSL_HAS_ECC),y) -CONFIGURE_ARGS += \ - --enable-ecc \ - --enable-supportedcurves -endif - -ifeq ($(CONFIG_WOLFSSL_HAS_DH),y) -CONFIGURE_ARGS += \ - --enable-dh -endif - -ifneq ($(CONFIG_WOLFSSL_HAS_ARC4),y) -CONFIGURE_ARGS += \ - --disable-arc4 -else -CONFIGURE_ARGS += \ - --enable-arc4 -endif - -ifneq ($(CONFIG_WOLFSSL_HAS_DES3),y) -CONFIGURE_ARGS += \ - --disable-des3 -else -CONFIGURE_ARGS += \ - --enable-des3 -endif - -ifeq ($(CONFIG_WOLFSSL_HAS_PSK),y) -CONFIGURE_ARGS += \ - --enable-psk -endif - -ifeq ($(CONFIG_WOLFSSL_HAS_SESSION_TICKET),y) -CONFIGURE_ARGS += \ - --enable-session-ticket -endif - -ifeq ($(CONFIG_WOLFSSL_HAS_DTLS),y) -CONFIGURE_ARGS += \ - --enable-dtls -endif + --disable-jobserver \ + --$(if $(CONFIG_IPV6),enable,disable)-ipv6 \ + --$(if $(CONFIG_WOLFSSL_HAS_AES_CCM),enable,disable)-aesccm \ + --$(if $(CONFIG_WOLFSSL_HAS_CHACHA_POLY),enable,disable)-chacha \ + --$(if $(CONFIG_WOLFSSL_HAS_CHACHA_POLY),enable,disable)-poly1305 \ + --$(if $(CONFIG_WOLFSSL_HAS_DH),enable,disable)-dh \ + --$(if $(CONFIG_WOLFSSL_HAS_ARC4),enable,disable)-arc4 \ + --$(if $(CONFIG_WOLFSSL_HAS_TLSV10),enable,disable)-tlsv10 \ + --$(if $(CONFIG_WOLFSSL_HAS_TLSV13),enable,disable)-tls13 \ + --$(if $(CONFIG_WOLFSSL_HAS_SESSION_TICKET),enable,disable)-session-ticket \ + --$(if $(CONFIG_WOLFSSL_HAS_DTLS),enable,disable)-dtls \ + --$(if $(CONFIG_WOLFSSL_HAS_ECC25519),enable,disable)-curve25519 \ + --$(if $(CONFIG_WOLFSSL_HAS_AFALG),enable,disable)-afalg \ + --enable-devcrypto=$(if $(CONFIG_WOLFSSL_HAS_DEVCRYPTO_CBC),cbc\ + ,$(if $(CONFIG_WOLFSSL_HAS_DEVCRYPTO_AES),aes\ + ,$(if $(CONFIG_WOLFSSL_HAS_DEVCRYPTO_FULL),yes,no))) ifeq ($(CONFIG_WOLFSSL_HAS_OCSP),y) CONFIGURE_ARGS += \ @@ -137,23 +91,6 @@ CONFIGURE_ARGS += \ --enable-wpas --enable-sha512 --enable-fortress --enable-fastmath endif -ifeq ($(CONFIG_WOLFSSL_HAS_ECC25519),y) -CONFIGURE_ARGS += \ - --enable-curve25519 -endif - -ifneq ($(CONFIG_WOLFSSL_HAS_POLY1305),y) -CONFIGURE_ARGS += \ - --enable-poly1305 -endif - -#ifneq ($(CONFIG_TARGET_x86),) -# CONFIGURE_ARGS += --enable-intelasm -#endif -#ifneq ($(CONFIG_TARGET_x86_64),) -# CONFIGURE_ARGS += --enable-intelasm -#endif - define Build/InstallDev $(INSTALL_DIR) $(1)/usr/include $(1)/usr/lib/pkgconfig $(CP) $(PKG_INSTALL_DIR)/usr/include/* $(1)/usr/include/ @@ -168,8 +105,7 @@ endef define Package/libwolfssl/install $(INSTALL_DIR) $(1)/usr/lib - $(CP) $(PKG_INSTALL_DIR)/usr/lib/libwolfssl.so* $(1)/usr/lib/ - ln -s libwolfssl.so $(1)/usr/lib/libcyassl.so + $(CP) $(PKG_INSTALL_DIR)/usr/lib/libwolfssl.so.* $(1)/usr/lib/ endef $(eval $(call BuildPackage,libwolfssl)) diff --git a/package/libs/wolfssl/patches/010-Make-RsaUnPad-constant-time-when-Block-Type-2-messag.patch b/package/libs/wolfssl/patches/010-Make-RsaUnPad-constant-time-when-Block-Type-2-messag.patch deleted file mode 100644 index 7f0a6efc00..0000000000 --- a/package/libs/wolfssl/patches/010-Make-RsaUnPad-constant-time-when-Block-Type-2-messag.patch +++ /dev/null @@ -1,562 +0,0 @@ -From 278d54d95de9fa80b4ac9f6dd0f900841114ca8c Mon Sep 17 00:00:00 2001 -From: Sean Parkinson -Date: Mon, 27 Aug 2018 10:16:40 +1000 -Subject: [PATCH] Make RsaUnPad constant time when Block Type 2 message - -(cherry picked from commit ab03f9291b040269ae21d33b9f01529ed8311728) -[cherry-pick changes] -Signed-off-by: Eneas U de Queiroz - ---- a/src/internal.c -+++ b/src/internal.c -@@ -24766,26 +24766,22 @@ static int DoSessionTicket(WOLFSSL* ssl, - * indistinguishable from correctly formatted RSA blocks - */ - -- ret = args->lastErr; - args->lastErr = 0; /* reset */ - - /* build PreMasterSecret */ - ssl->arrays->preMasterSecret[0] = ssl->chVersion.major; - ssl->arrays->preMasterSecret[1] = ssl->chVersion.minor; -- if (ret == 0 && args->sigSz == SECRET_LEN && -- args->output != NULL) { -+ if (args->output != NULL) { - XMEMCPY(&ssl->arrays->preMasterSecret[VERSION_SZ], -- &args->output[VERSION_SZ], -- SECRET_LEN - VERSION_SZ); -+ &args->output[VERSION_SZ], -+ SECRET_LEN - VERSION_SZ); - } -- else { -- /* preMasterSecret has RNG and version set */ -- /* return proper length and ignore error */ -- /* error will be caught as decryption error */ -- args->sigSz = SECRET_LEN; -- ret = 0; -- } -- -+ /* preMasterSecret has RNG and version set -+ * return proper length and ignore error -+ * error will be caught as decryption error -+ */ -+ args->sigSz = SECRET_LEN; -+ ret = 0; - break; - } /* rsa_kea */ - #endif /* !NO_RSA */ ---- a/src/tls.c -+++ b/src/tls.c -@@ -1136,12 +1136,12 @@ static int Hmac_UpdateFinal_CT(Hmac* hma - else if (k < maxLen) - b = in[k - WOLFSSL_TLS_HMAC_INNER_SZ]; - -- b = ctMaskSel(atEoc, b, 0x80); -+ b = ctMaskSel(atEoc, 0x80, b); - b &= ~pastEoc; - b &= ~isOutBlock | isEocBlock; - - if (j >= blockSz - 8) { -- b = ctMaskSel(isOutBlock, b, lenBytes[j - (blockSz - 8)]); -+ b = ctMaskSel(isOutBlock, lenBytes[j - (blockSz - 8)], b); - } - - hashBlock[j] = b; ---- a/wolfcrypt/src/integer.c -+++ b/wolfcrypt/src/integer.c -@@ -321,6 +321,17 @@ int mp_to_unsigned_bin (mp_int * a, unsi - return res; - } - -+int mp_to_unsigned_bin_len(mp_int * a, unsigned char *b, int c) -+{ -+ int i, len; -+ -+ len = mp_unsigned_bin_size(a); -+ -+ /* pad front w/ zeros to match length */ -+ for (i = 0; i < c - len; i++) -+ b[i] = 0x00; -+ return mp_to_unsigned_bin(a, b + i); -+} - - /* creates "a" then copies b into it */ - int mp_init_copy (mp_int * a, mp_int * b) ---- a/wolfcrypt/src/misc.c -+++ b/wolfcrypt/src/misc.c -@@ -341,10 +341,22 @@ STATIC INLINE byte ctMaskEq(int a, int b - return 0 - (a == b); - } - --/* Constant time - select b when mask is set and a otherwise. */ -+/* Constant time - mask set when a != b. */ -+STATIC INLINE byte ctMaskNotEq(int a, int b) -+{ -+ return 0 - (a != b); -+} -+ -+/* Constant time - select a when mask is set and b otherwise. */ - STATIC INLINE byte ctMaskSel(byte m, byte a, byte b) - { -- return (a & ~m) | (b & m); -+ return (b & ~m) | (a & m); -+} -+ -+/* Constant time - select integer a when mask is set and integer b otherwise. */ -+STATIC INLINE int ctMaskSelInt(byte m, int a, int b) -+{ -+ return (b & (~(int)(char)m)) | (a & ((int)(char)m)); - } - - /* Constant time - bit set when a <= b. */ ---- a/wolfcrypt/src/rsa.c -+++ b/wolfcrypt/src/rsa.c -@@ -989,10 +989,8 @@ static int RsaUnPad_OAEP(byte *pkcsBlock - ret += pkcsBlock[idx++] ^ 0x01; /* separator value is 0x01 */ - ret += pkcsBlock[0] ^ 0x00; /* Y, the first value, should be 0 */ - -- if (ret != 0) { -- WOLFSSL_MSG("RsaUnPad_OAEP: Padding Error"); -- return BAD_PADDING_E; -- } -+ /* Return 0 data length on error. */ -+ idx = ctMaskSelInt(ctMaskEq(ret, 0), idx, pkcsBlockLen); - - /* adjust pointer to correct location in array and return size of M */ - *output = (byte*)(pkcsBlock + idx); -@@ -1078,48 +1076,60 @@ static int RsaUnPad_PSS(byte *pkcsBlock, - /* UnPad plaintext, set start to *output, return length of plaintext, - * < 0 on error */ - static int RsaUnPad(const byte *pkcsBlock, unsigned int pkcsBlockLen, -- byte **output, byte padValue) -+ byte **output, byte padValue) - { -- word32 maxOutputLen = (pkcsBlockLen > 10) ? (pkcsBlockLen - 10) : 0; -- word32 invalid = 0; -- word32 i = 1; -- word32 outputLen; -+ int ret; -+ word32 i; -+ byte invalid = 0; - - if (output == NULL || pkcsBlockLen == 0) { - return BAD_FUNC_ARG; - } - -- if (pkcsBlock[0] != 0x0) { /* skip past zero */ -- invalid = 1; -- } -- pkcsBlock++; pkcsBlockLen--; -+ if (padValue == RSA_BLOCK_TYPE_1) { -+ /* First byte must be 0x00 and Second byte, block type, 0x01 */ -+ if (pkcsBlock[0] != 0 || pkcsBlock[1] != RSA_BLOCK_TYPE_1) { -+ WOLFSSL_MSG("RsaUnPad error, invalid formatting"); -+ return RSA_PAD_E; -+ } - -- /* Require block type padValue */ -- invalid = (pkcsBlock[0] != padValue) || invalid; -+ /* check the padding until we find the separator */ -+ for (i = 2; i < pkcsBlockLen && pkcsBlock[i++] == 0xFF; ) { } - -- /* verify the padding until we find the separator */ -- if (padValue == RSA_BLOCK_TYPE_1) { -- while (i maxOutputLen) || invalid; -+ /* Decrypted with private key - unpad must be constant time. */ -+ for (i = 0, j = 2; j < pkcsBlockLen; j++) { -+ /* Update i if not passed the separator and at separator. */ -+ i |= (~pastSep) & ctMaskEq(pkcsBlock[j], 0x00) & (j + 1); -+ pastSep |= ctMaskEq(pkcsBlock[j], 0x00); -+ } -+ -+ /* Minimum of 11 bytes of pre-message data - including leading 0x00. */ -+ invalid |= ctMaskLT(i, RSA_MIN_PAD_SZ); -+ /* Must have seen separator. */ -+ invalid |= ~pastSep; -+ /* First byte must be 0x00. */ -+ invalid |= ctMaskNotEq(pkcsBlock[0], 0x00); -+ /* Check against expected block type: padValue */ -+ invalid |= ctMaskNotEq(pkcsBlock[1], padValue); - -- if (invalid) { -- WOLFSSL_MSG("RsaUnPad error, invalid formatting"); -- return RSA_PAD_E; -+ *output = (byte *)(pkcsBlock + i); -+ ret = ((int)~invalid) & (pkcsBlockLen - i); - } - -- *output = (byte *)(pkcsBlock + i); -- return outputLen; -+ return ret; - } - - /* helper function to direct unpadding -@@ -1249,7 +1259,7 @@ static int wc_RsaFunctionSync(const byte - mp_int rnd, rndi; - #endif - int ret = 0; -- word32 keyLen, len; -+ word32 keyLen; - #endif - - #ifdef WOLFSSL_HAVE_SP_RSA -@@ -1308,6 +1318,7 @@ static int wc_RsaFunctionSync(const byte - } - #endif - -+#ifndef TEST_UNPAD_CONSTANT_TIME - if (mp_read_unsigned_bin(&tmp, (byte*)in, inLen) != MP_OKAY) - ERROR_OUT(MP_READ_E); - -@@ -1418,21 +1429,18 @@ static int wc_RsaFunctionSync(const byte - ERROR_OUT(RSA_BUFFER_E); - } - -- len = mp_unsigned_bin_size(&tmp); -- -- /* pad front w/ zeros to match key length */ -- while (len < keyLen) { -- *out++ = 0x00; -- len++; -- } -- - *outLen = keyLen; -- -- /* convert */ -- if (mp_to_unsigned_bin(&tmp, out) != MP_OKAY) -+ if (mp_to_unsigned_bin_len(&tmp, out, keyLen) != MP_OKAY) - ERROR_OUT(MP_TO_E); - - done: -+#else -+ (void)type; -+ (void)key; -+ (void)keyLen; -+ XMEMCPY(out, in, inLen); -+ *outLen = inLen; -+#endif - mp_clear(&tmp); - #ifdef WC_RSA_BLINDING - if (type == RSA_PRIVATE_DECRYPT || type == RSA_PRIVATE_ENCRYPT) { -@@ -1633,6 +1641,7 @@ int wc_RsaFunction(const byte* in, word3 - } - #endif - -+#ifndef TEST_UNPAD_CONSTANT_TIME - #ifndef NO_RSA_BOUNDS_CHECK - if (type == RSA_PRIVATE_DECRYPT && - key->state == RSA_STATE_DECRYPT_EXPTMOD) { -@@ -1667,6 +1676,7 @@ int wc_RsaFunction(const byte* in, word3 - return ret; - } - #endif /* NO_RSA_BOUNDS_CHECK */ -+#endif - - #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_RSA) - if (key->asyncDev.marker == WOLFSSL_ASYNC_MARKER_RSA && -@@ -1880,7 +1890,8 @@ static int RsaPrivateDecryptEx(byte* in, - - /* if not doing this inline then allocate a buffer for it */ - if (outPtr == NULL) { -- key->data = (byte*)XMALLOC(inLen, key->heap, DYNAMIC_TYPE_WOLF_BIGINT); -+ key->data = (byte*)XMALLOC(inLen, key->heap, -+ DYNAMIC_TYPE_WOLF_BIGINT); - key->dataIsAlloc = 1; - if (key->data == NULL) { - ret = MEMORY_E; -@@ -1909,20 +1920,29 @@ static int RsaPrivateDecryptEx(byte* in, - ret = wc_RsaUnPad_ex(key->data, key->dataLen, &pad, pad_value, pad_type, - hash, mgf, label, labelSz, saltLen, - mp_count_bits(&key->n), key->heap); -- if (ret > 0 && ret <= (int)outLen && pad != NULL) { -+ if (rsa_type == RSA_PUBLIC_DECRYPT && ret > (int)outLen) -+ ret = RSA_BUFFER_E; -+ else if (ret >= 0 && pad != NULL) { -+ char c; -+ - /* only copy output if not inline */ - if (outPtr == NULL) { -- XMEMCPY(out, pad, ret); -+ word32 i, j; -+ int start = (int)((size_t)pad - (size_t)key->data); -+ -+ for (i = 0, j = 0; j < key->dataLen; j++) { -+ out[i] = key->data[j]; -+ c = ctMaskGTE(j, start); -+ c &= ctMaskLT(i, outLen); -+ /* 0 - no add, -1 add */ -+ i += -c; -+ } - } -- else { -+ else - *outPtr = pad; -- } -- } -- else if (ret >= 0) { -- ret = RSA_BUFFER_E; -- } -- if (ret < 0) { -- break; -+ -+ ret = ctMaskSelInt(ctMaskLTE(ret, outLen), ret, RSA_BUFFER_E); -+ ret = ctMaskSelInt(ctMaskNotEq(ret, 0), ret, RSA_BUFFER_E); - } - - key->state = RSA_STATE_DECRYPT_RES; -@@ -1934,12 +1954,14 @@ static int RsaPrivateDecryptEx(byte* in, - defined(HAVE_CAVIUM) - if (key->asyncDev.marker == WOLFSSL_ASYNC_MARKER_RSA && - pad_type != WC_RSA_PSS_PAD) { -- /* convert result */ -- byte* dataLen = (byte*)&key->dataLen; -- ret = (dataLen[0] << 8) | (dataLen[1]); -+ if (ret > 0) { -+ /* convert result */ -+ byte* dataLen = (byte*)&key->dataLen; -+ ret = (dataLen[0] << 8) | (dataLen[1]); - -- if (outPtr) -- *outPtr = in; -+ if (outPtr) -+ *outPtr = in; -+ } - } - #endif - break; ---- a/wolfcrypt/src/sp_int.c -+++ b/wolfcrypt/src/sp_int.c -@@ -286,7 +286,8 @@ int sp_leading_bit(sp_int* a) - * The array must be large enough for encoded number - use mp_unsigned_bin_size - * to calculate the number of bytes required. - * -- * a SP integer. -+ * a SP integer. -+ * out Array to put encoding into. - * returns MP_OKAY always. - */ - int sp_to_unsigned_bin(sp_int* a, byte* out) -@@ -305,6 +306,31 @@ int sp_to_unsigned_bin(sp_int* a, byte* - return MP_OKAY; - } - -+/* Convert the big number to an array of bytes in big-endian format. -+ * The array must be large enough for encoded number - use mp_unsigned_bin_size -+ * to calculate the number of bytes required. -+ * Front-pads the output array with zeros make number the size of the array. -+ * -+ * a SP integer. -+ * out Array to put encoding into. -+ * outSz Size of the array. -+ * returns MP_OKAY always. -+ */ -+int sp_to_unsigned_bin_len(sp_int* a, byte* out, int outSz) -+{ -+ int i, j, b; -+ -+ j = outSz - 1; -+ for (i=0; j>=0; i++) { -+ for (b = 0; b < SP_WORD_SIZE; b += 8) { -+ out[j--] = a->dp[i] >> b; -+ if (j < 0) -+ break; -+ } -+ } -+ -+ return MP_OKAY; -+} - /* Ensure the data in the big number is zeroed. - * - * a SP integer. ---- a/wolfcrypt/src/tfm.c -+++ b/wolfcrypt/src/tfm.c -@@ -1964,6 +1964,48 @@ void fp_to_unsigned_bin(fp_int *a, unsig - fp_reverse (b, x); - } - -+int fp_to_unsigned_bin_len(fp_int *a, unsigned char *b, int c) -+{ -+#if DIGIT_BIT == 64 || DIGIT_BIT == 32 -+ int i, j, x; -+ -+ for (x=c-1,j=0,i=0; x >= 0; x--) { -+ b[x] = (unsigned char)(a->dp[i] >> j); -+ j += 8; -+ i += j == DIGIT_BIT; -+ j &= DIGIT_BIT - 1; -+ } -+ -+ return FP_OKAY; -+#else -+ int x; -+#ifndef WOLFSSL_SMALL_STACK -+ fp_int t[1]; -+#else -+ fp_int *t; -+#endif -+ -+#ifdef WOLFSSL_SMALL_STACK -+ t = (fp_int*)XMALLOC(sizeof(fp_int), NULL, DYNAMIC_TYPE_TMP_BUFFER); -+ if (t == NULL) -+ return FP_MEM; -+#endif -+ -+ fp_init_copy(t, a); -+ -+ for (x = 0; x < c; x++) { -+ b[x] = (unsigned char) (t->dp[0] & 255); -+ fp_div_2d (t, 8, t, NULL); -+ } -+ fp_reverse (b, x); -+ -+#ifdef WOLFSSL_SMALL_STACK -+ XFREE(t, NULL, DYNAMIC_TYPE_TMP_BUFFER); -+#endif -+ return FP_OKAY; -+#endif -+} -+ - int fp_unsigned_bin_size(fp_int *a) - { - int size = fp_count_bits (a); -@@ -2435,6 +2477,10 @@ int mp_to_unsigned_bin (mp_int * a, unsi - return MP_OKAY; - } - -+int mp_to_unsigned_bin_len(mp_int * a, unsigned char *b, int c) -+{ -+ return fp_to_unsigned_bin_len(a, b, c); -+} - /* reads a unsigned char array, assumes the msb is stored first [big endian] */ - int mp_read_unsigned_bin (mp_int * a, const unsigned char *b, int c) - { ---- a/wolfssl/wolfcrypt/integer.h -+++ b/wolfssl/wolfcrypt/integer.h -@@ -277,6 +277,7 @@ MP_API int mp_unsigned_bin_size(mp_int - MP_API int mp_read_unsigned_bin (mp_int * a, const unsigned char *b, int c); - MP_API int mp_to_unsigned_bin_at_pos(int x, mp_int *t, unsigned char *b); - MP_API int mp_to_unsigned_bin (mp_int * a, unsigned char *b); -+MP_API int mp_to_unsigned_bin_len(mp_int * a, unsigned char *b, int c); - MP_API int mp_exptmod (mp_int * G, mp_int * X, mp_int * P, mp_int * Y); - /* end functions needed by Rsa */ - ---- a/wolfssl/wolfcrypt/misc.h -+++ b/wolfssl/wolfcrypt/misc.h -@@ -97,7 +97,9 @@ WOLFSSL_LOCAL byte ctMaskGTE(int a, int - WOLFSSL_LOCAL byte ctMaskLT(int a, int b); - WOLFSSL_LOCAL byte ctMaskLTE(int a, int b); - WOLFSSL_LOCAL byte ctMaskEq(int a, int b); -+WOLFSSL_LOCAL byte ctMaskNotEq(int a, int b); - WOLFSSL_LOCAL byte ctMaskSel(byte m, byte a, byte b); -+WOLFSSL_LOCAL int ctMaskSelInt(byte m, int a, int b); - WOLFSSL_LOCAL byte ctSetLTE(int a, int b); - - #endif /* NO_INLINE */ ---- a/wolfssl/wolfcrypt/sp_int.h -+++ b/wolfssl/wolfcrypt/sp_int.h -@@ -119,7 +119,8 @@ MP_API int sp_read_radix(sp_int* a, cons - MP_API int sp_cmp(sp_int* a, sp_int* b); - MP_API int sp_count_bits(sp_int* a); - MP_API int sp_leading_bit(sp_int* a); --MP_API int sp_to_unsigned_bin(sp_int* a, byte* in); -+MP_API int sp_to_unsigned_bin(sp_int* a, byte* out); -+MP_API int sp_to_unsigned_bin_len(sp_int* a, byte* out, int outSz); - MP_API void sp_forcezero(sp_int* a); - MP_API int sp_copy(sp_int* a, sp_int* b); - MP_API int sp_set(sp_int* a, sp_int_digit d); -@@ -156,30 +157,31 @@ typedef sp_digit mp_digit; - - #define mp_free(a) - --#define mp_init sp_init --#define mp_init_multi sp_init_multi --#define mp_clear sp_clear --#define mp_read_unsigned_bin sp_read_unsigned_bin --#define mp_unsigned_bin_size sp_unsigned_bin_size --#define mp_read_radix sp_read_radix --#define mp_cmp sp_cmp --#define mp_count_bits sp_count_bits --#define mp_leading_bit sp_leading_bit --#define mp_to_unsigned_bin sp_to_unsigned_bin --#define mp_forcezero sp_forcezero --#define mp_copy sp_copy --#define mp_set sp_set --#define mp_iszero sp_iszero --#define mp_clamp sp_clamp --#define mp_grow sp_grow --#define mp_sub_d sp_sub_d --#define mp_cmp_d sp_cmp_d --#define mp_mod sp_mod --#define mp_zero sp_zero --#define mp_add_d sp_add_d --#define mp_lshd sp_lshd --#define mp_add sp_add --#define mp_isodd sp_isodd -+#define mp_init sp_init -+#define mp_init_multi sp_init_multi -+#define mp_clear sp_clear -+#define mp_read_unsigned_bin sp_read_unsigned_bin -+#define mp_unsigned_bin_size sp_unsigned_bin_size -+#define mp_read_radix sp_read_radix -+#define mp_cmp sp_cmp -+#define mp_count_bits sp_count_bits -+#define mp_leading_bit sp_leading_bit -+#define mp_to_unsigned_bin sp_to_unsigned_bin -+#define mp_to_unsigned_bin_len sp_to_unsigned_bin_len -+#define mp_forcezero sp_forcezero -+#define mp_copy sp_copy -+#define mp_set sp_set -+#define mp_iszero sp_iszero -+#define mp_clamp sp_clamp -+#define mp_grow sp_grow -+#define mp_sub_d sp_sub_d -+#define mp_cmp_d sp_cmp_d -+#define mp_mod sp_mod -+#define mp_zero sp_zero -+#define mp_add_d sp_add_d -+#define mp_lshd sp_lshd -+#define mp_add sp_add -+#define mp_isodd sp_isodd - - #define MP_INT_DEFINED - ---- a/wolfssl/wolfcrypt/tfm.h -+++ b/wolfssl/wolfcrypt/tfm.h -@@ -563,6 +563,7 @@ int fp_leading_bit(fp_int *a); - int fp_unsigned_bin_size(fp_int *a); - void fp_read_unsigned_bin(fp_int *a, const unsigned char *b, int c); - void fp_to_unsigned_bin(fp_int *a, unsigned char *b); -+int fp_to_unsigned_bin_len(fp_int *a, unsigned char *b, int c); - int fp_to_unsigned_bin_at_pos(int x, fp_int *t, unsigned char *b); - - /*int fp_signed_bin_size(fp_int *a);*/ -@@ -686,6 +687,7 @@ MP_API int mp_unsigned_bin_size(mp_int - MP_API int mp_read_unsigned_bin (mp_int * a, const unsigned char *b, int c); - MP_API int mp_to_unsigned_bin_at_pos(int x, mp_int *t, unsigned char *b); - MP_API int mp_to_unsigned_bin (mp_int * a, unsigned char *b); -+MP_API int mp_to_unsigned_bin_len(mp_int * a, unsigned char *b, int c); - - MP_API int mp_sub_d(fp_int *a, fp_digit b, fp_int *c); - MP_API int mp_copy(fp_int* a, fp_int* b); diff --git a/package/libs/wolfssl/patches/020-Improve-nonce-use-in-ECC-mulmod.patch b/package/libs/wolfssl/patches/020-Improve-nonce-use-in-ECC-mulmod.patch deleted file mode 100644 index 93de6b509d..0000000000 --- a/package/libs/wolfssl/patches/020-Improve-nonce-use-in-ECC-mulmod.patch +++ /dev/null @@ -1,98 +0,0 @@ -From ba4d612892bf6e3aae9cca7edce2a6d6b43e3e22 Mon Sep 17 00:00:00 2001 -From: Sean Parkinson -Date: Wed, 17 Jul 2019 08:26:02 +1000 -Subject: [PATCH] Improve nonce use in ECC mulmod - -(cherry picked from commit 483f6a5acd9808b405306661c121aa6407464dc2) - ---- a/wolfcrypt/src/ecc.c -+++ b/wolfcrypt/src/ecc.c -@@ -2039,7 +2039,7 @@ int wc_ecc_mulmod_ex(mp_int* k, ecc_poin - #define M_POINTS 8 - int first = 1, bitbuf = 0, bitcpy = 0, j; - #else -- #define M_POINTS 3 -+ #define M_POINTS 4 - #endif - - ecc_point *tG, *M[M_POINTS]; -@@ -2253,7 +2253,9 @@ int wc_ecc_mulmod_ex(mp_int* k, ecc_poin - mode = 0; - bitcnt = 1; - buf = 0; -- digidx = get_digit_count(k) - 1; -+ digidx = get_digit_count(modulus) - 1; -+ /* The order MAY be 1 bit longer than the modulus. */ -+ digidx += (modulus->dp[digidx] >> (DIGIT_BIT-1)); - - /* perform ops */ - if (err == MP_OKAY) { -@@ -2272,25 +2274,53 @@ int wc_ecc_mulmod_ex(mp_int* k, ecc_poin - i = (buf >> (DIGIT_BIT - 1)) & 1; - buf <<= 1; - -- if (mode == 0 && i == 0) { -+ if (mode == 0) { -+ mode = i; - /* timing resistant - dummy operations */ - if (err == MP_OKAY) -- err = ecc_projective_add_point(M[0], M[1], M[2], a, modulus, -+ err = ecc_projective_add_point(M[1], M[2], M[2], a, modulus, - mp); -+#ifdef WC_NO_CACHE_RESISTANT - if (err == MP_OKAY) -- err = ecc_projective_dbl_point(M[1], M[2], a, modulus, mp); -- if (err == MP_OKAY) -- continue; -- } -- -- if (mode == 0 && i == 1) { -- mode = 1; -- /* timing resistant - dummy operations */ -- if (err == MP_OKAY) -- err = ecc_projective_add_point(M[0], M[1], M[2], a, modulus, -- mp); -- if (err == MP_OKAY) -- err = ecc_projective_dbl_point(M[1], M[2], a, modulus, mp); -+ err = ecc_projective_dbl_point(M[2], M[3], a, modulus, mp); -+#else -+ /* instead of using M[i] for double, which leaks key bit to cache -+ * monitor, use M[2] as temp, make sure address calc is constant, -+ * keep M[0] and M[1] in cache */ -+ if (err == MP_OKAY) -+ err = mp_copy((mp_int*) -+ ( ((wolfssl_word)M[0]->x & wc_off_on_addr[i^1]) + -+ ((wolfssl_word)M[1]->x & wc_off_on_addr[i])), -+ M[2]->x); -+ if (err == MP_OKAY) -+ err = mp_copy((mp_int*) -+ ( ((wolfssl_word)M[0]->y & wc_off_on_addr[i^1]) + -+ ((wolfssl_word)M[1]->y & wc_off_on_addr[i])), -+ M[2]->y); -+ if (err == MP_OKAY) -+ err = mp_copy((mp_int*) -+ ( ((wolfssl_word)M[0]->z & wc_off_on_addr[i^1]) + -+ ((wolfssl_word)M[1]->z & wc_off_on_addr[i])), -+ M[2]->z); -+ if (err == MP_OKAY) -+ err = ecc_projective_dbl_point(M[2], M[3], a, modulus, mp); -+ /* copy M[2] back to M[i] */ -+ if (err == MP_OKAY) -+ err = mp_copy(M[2]->x, -+ (mp_int*) -+ ( ((wolfssl_word)M[0]->x & wc_off_on_addr[i^1]) + -+ ((wolfssl_word)M[1]->x & wc_off_on_addr[i])) ); -+ if (err == MP_OKAY) -+ err = mp_copy(M[2]->y, -+ (mp_int*) -+ ( ((wolfssl_word)M[0]->y & wc_off_on_addr[i^1]) + -+ ((wolfssl_word)M[1]->y & wc_off_on_addr[i])) ); -+ if (err == MP_OKAY) -+ err = mp_copy(M[2]->z, -+ (mp_int*) -+ ( ((wolfssl_word)M[0]->z & wc_off_on_addr[i^1]) + -+ ((wolfssl_word)M[1]->z & wc_off_on_addr[i])) ); -+#endif - if (err == MP_OKAY) - continue; - } diff --git a/package/libs/wolfssl/patches/100-disable-hardening-check.patch b/package/libs/wolfssl/patches/100-disable-hardening-check.patch index d913b5fdea..5d83eca770 100644 --- a/package/libs/wolfssl/patches/100-disable-hardening-check.patch +++ b/package/libs/wolfssl/patches/100-disable-hardening-check.patch @@ -1,6 +1,6 @@ --- a/wolfssl/wolfcrypt/settings.h +++ b/wolfssl/wolfcrypt/settings.h -@@ -1624,7 +1624,7 @@ extern void uITRON4_free(void *p) ; +@@ -1930,7 +1930,7 @@ extern void uITRON4_free(void *p) ; #endif /* warning for not using harden build options (default with ./configure) */ @@ -8,4 +8,4 @@ +#if 0 #if (defined(USE_FAST_MATH) && !defined(TFM_TIMING_RESISTANT)) || \ (defined(HAVE_ECC) && !defined(ECC_TIMING_RESISTANT)) || \ - (!defined(NO_RSA) && !defined(WC_RSA_BLINDING) && !defined(HAVE_FIPS)) + (!defined(NO_RSA) && !defined(WC_RSA_BLINDING) && !defined(HAVE_FIPS) && \ diff --git a/package/libs/wolfssl/patches/400-additional_compatibility.patch b/package/libs/wolfssl/patches/400-additional_compatibility.patch deleted file mode 100644 index 1464e9d2a8..0000000000 --- a/package/libs/wolfssl/patches/400-additional_compatibility.patch +++ /dev/null @@ -1,12 +0,0 @@ ---- a/cyassl/openssl/ssl.h -+++ b/cyassl/openssl/ssl.h -@@ -28,6 +28,9 @@ - #define CYASSL_OPENSSL_H_ - - #include -+#ifndef HAVE_SNI -+#undef CYASSL_SNI_HOST_NAME -+#endif - #include - - #endif diff --git a/package/libs/wolfssl/patches/900-remove-broken-autoconf-macros.patch b/package/libs/wolfssl/patches/900-remove-broken-autoconf-macros.patch deleted file mode 100644 index 66582cfc46..0000000000 --- a/package/libs/wolfssl/patches/900-remove-broken-autoconf-macros.patch +++ /dev/null @@ -1,21 +0,0 @@ ---- a/configure.ac -+++ b/configure.ac -@@ -4198,7 +4198,6 @@ AC_CONFIG_FILES([stamp-h], [echo timesta - AC_CONFIG_FILES([Makefile wolfssl/version.h wolfssl/options.h cyassl/options.h support/wolfssl.pc rpm/spec]) - - AX_CREATE_GENERIC_CONFIG --AX_AM_JOBSERVER([yes]) - - AC_OUTPUT - ---- a/Makefile.am -+++ b/Makefile.am -@@ -20,8 +20,6 @@ dist_noinst_SCRIPTS = - noinst_SCRIPTS = - check_SCRIPTS = - --#includes additional rules from aminclude.am --@INC_AMINCLUDE@ - DISTCLEANFILES+= aminclude.am - - CLEANFILES+= cert.der \