WolfSSL
/
wolfssh
mirror of https://github.com/wolfSSL/wolfssh.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #400 from dgarske/fips 

Fixes for building with FIPS
pull/401/head v1.4.9
John Safranek 2022-04-04 16:39:55 -07:00 committed by GitHub
parent fd77d6f61a 76ba904819
commit dadccc88ff
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 62 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
src/internal.c
View File

@ -3248,10 +3248,16 @@ static int DoKexDhReply(WOLFSSH* ssh, byte* buf, word32 len, word32* idx)
ssh->kSz = MAX_KEX_KEY_SZ;
if (!ssh->handshake->useEcc) {
#ifndef WOLFSSH_NO_DH
#ifdef PRIVATE_KEY_UNLOCK
PRIVATE_KEY_UNLOCK();
#endif
ret = wc_DhAgree(&ssh->handshake->privKey.dh,
ssh->k, &ssh->kSz,
ssh->handshake->x, ssh->handshake->xSz,
f, fSz);
#ifdef PRIVATE_KEY_LOCK
PRIVATE_KEY_LOCK();
#endif
ForceZero(ssh->handshake->x, ssh->handshake->xSz);
wc_FreeDhKey(&ssh->handshake->privKey.dh);
if (ret != 0) {
@ -3272,10 +3278,14 @@ static int DoKexDhReply(WOLFSSH* ssh, byte* buf, word32 len, word32* idx)
if (ret == 0)
ret = wc_ecc_import_x963(f, fSz, key_ptr);
if (ret == 0) {
#ifdef PRIVATE_KEY_UNLOCK
PRIVATE_KEY_UNLOCK();
#endif
ret = wc_ecc_shared_secret(&ssh->handshake->privKey.ecc,
key_ptr, ssh->k, &ssh->kSz);
#ifdef PRIVATE_KEY_LOCK
PRIVATE_KEY_LOCK();
#endif
}
wc_ecc_free(key_ptr);
wc_ecc_free(&ssh->handshake->privKey.ecc);
@ -7074,11 +7084,15 @@ int SendKexDhReply(WOLFSSH* ssh)
ssh->ctx->privateKeySz);
/* Flatten the public key into x963 value for the exchange hash. */
if (ret == 0) {
#ifdef PRIVATE_KEY_UNLOCK
PRIVATE_KEY_UNLOCK();
#endif
ret = wc_ecc_export_x963(&sigKeyBlock_ptr->sk.ecc.key,
sigKeyBlock_ptr->sk.ecc.q,
&sigKeyBlock_ptr->sk.ecc.qSz);
#ifdef PRIVATE_KEY_LOCK
PRIVATE_KEY_LOCK();
#endif
}
/* Hash in the length of the public key block. */
if (ret == 0) {
@ -7254,9 +7268,16 @@ int SendKexDhReply(WOLFSSH* ssh)
if (ret == 0)
ret = wc_DhGenerateKeyPair(privKey, ssh->rng,
y_ptr, &ySz, f_ptr, &fSz);
if (ret == 0)
if (ret == 0) {
#ifdef PRIVATE_KEY_UNLOCK
PRIVATE_KEY_UNLOCK();
#endif
ret = wc_DhAgree(privKey, ssh->k, &ssh->kSz, y_ptr, ySz,
ssh->handshake->e, ssh->handshake->eSz);
#ifdef PRIVATE_KEY_LOCK
PRIVATE_KEY_LOCK();
#endif
}
ForceZero(y_ptr, ySz);
wc_FreeDhKey(privKey);
}
@ -7307,15 +7328,23 @@ int SendKexDhReply(WOLFSSH* ssh)
wc_ecc_get_curve_size_from_id(primeId),
privKey, primeId);
if (ret == 0) {
#ifdef PRIVATE_KEY_UNLOCK
PRIVATE_KEY_UNLOCK();
#endif
ret = wc_ecc_export_x963(privKey, f_ptr, &fSz);
#ifdef PRIVATE_KEY_LOCK
PRIVATE_KEY_LOCK();
#endif
}
if (ret == 0) {
#ifdef PRIVATE_KEY_UNLOCK
PRIVATE_KEY_UNLOCK();
#endif
ret = wc_ecc_shared_secret(privKey, pubKey,
ssh->k, &ssh->kSz);
#ifdef PRIVATE_KEY_LOCK
PRIVATE_KEY_LOCK();
#endif
}
wc_ecc_free(privKey);
wc_ecc_free(pubKey);
@ -7936,8 +7965,15 @@ int SendKexDhInit(WOLFSSH* ssh)
ret = wc_ecc_make_key_ex(ssh->rng,
wc_ecc_get_curve_size_from_id(primeId),
privKey, primeId);
if (ret == 0)
if (ret == 0) {
#ifdef PRIVATE_KEY_UNLOCK
PRIVATE_KEY_UNLOCK();
#endif
ret = wc_ecc_export_x963(privKey, e, &eSz);
#ifdef PRIVATE_KEY_LOCK
PRIVATE_KEY_LOCK();
#endif
}
#else
ret = WS_INVALID_ALGO_ID;
#endif /* !defined(WOLFSSH_NO_ECDH) */

22
src/ssh.c
View File

@ -32,6 +32,8 @@
#include <wolfssh/internal.h>
#include <wolfssh/log.h>
#include <wolfssl/wolfcrypt/wc_port.h>
#include <wolfssl/wolfcrypt/error-crypt.h>
#include <wolfssl/wolfcrypt/random.h>
#ifdef NO_INLINE
#include <wolfssh/misc.h>
@ -40,6 +42,19 @@
#include "src/misc.c"
#endif
#ifdef HAVE_FIPS
static void myFipsCb(int ok, int err, const char* hash)
{
printf("in my Fips callback, ok = %d, err = %d\n", ok, err);
printf("message = %s\n", wc_GetErrorString(err));
printf("hash = %s\n", hash);
if (err == IN_CORE_FIPS_E) {
printf("In core integrity hash check failure, copy above hash\n");
printf("into verifyCore[] in fips_test.c and rebuild\n");
}
}
#endif /* HAVE_FIPS */
int wolfSSH_Init(void)
{
@ -49,6 +64,13 @@ int wolfSSH_Init(void)
if (wolfCrypt_Init() != 0)
ret = WS_CRYPTO_FAILED;
#ifdef HAVE_FIPS
wolfCrypt_SetCb_fips(myFipsCb);
#endif
#ifdef WC_RNG_SEED_CB
wc_SetSeed_Cb(wc_GenerateSeed);
#endif
WLOG(WS_LOG_DEBUG, "Leaving wolfSSH_Init(), returning %d", ret);
return ret;
}

3
tests/testsuite.c
View File

@ -103,10 +103,11 @@ int TestsuiteTest(int argc, char** argv)
WSTARTTCP();
wolfSSH_Init();
#if defined(DEBUG_WOLFSSH)
wolfSSH_Debugging_ON();
#endif
wolfSSH_Init();
#if !defined(WOLFSSL_TIRTOS)
ChangeToWolfSshRoot();
#endif