Skip to content

Commit 1a67eb7

Browse files
dgarskedgarske
authored
Merge pull request #9851 from night1rider/setkey-callbacks
Setkey/Export callbacks
2 parents 240703c + a99a720 commit 1a67eb7

File tree

12 files changed

+1771
-83
lines changed

12 files changed

+1771
-83
lines changed

‎.github/workflows/os-check.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,14 @@ jobs:
6161
CPPFLAGS=-DWOLFSSL_TLS13_IGNORE_PT_ALERT_ON_ENC',
6262
'--enable-all --enable-certgencache',
6363
'--enable-all --enable-dilithium --enable-cryptocb --enable-cryptocbutils --enable-pkcallbacks',
64+
'--enable-cryptocb --enable-aesgcm CPPFLAGS="-DWOLF_CRYPTO_CB_AES_SETKEY"',
65+
'--enable-cryptocb --enable-keygen --enable-cryptocbutils=setkey',
66+
'--enable-cryptocb --enable-keygen --enable-cryptocbutils CPPFLAGS="-DWOLF_CRYPTO_CB_AES_SETKEY"',
67+
'--enable-cryptocb --enable-keygen --enable-aesgcm --enable-cryptocbutils=setkey,free CPPFLAGS="-DWOLF_CRYPTO_CB_AES_SETKEY"',
68+
'--enable-cryptocb --enable-keygen --enable-cryptocbutils=export',
69+
'--enable-cryptocb --enable-keygen CPPFLAGS="-DWOLF_CRYPTO_CB_EXPORT_KEY"',
70+
'--enable-cryptocb --enable-keygen --enable-aesgcm --enable-cryptocbutils=setkey,free,export CPPFLAGS="-DWOLF_CRYPTO_CB_AES_SETKEY"',
71+
'--enable-cryptocb --enable-keygen --enable-cryptocbutils=setkey,export CPPFLAGS="-DWOLF_CRYPTO_CB_FIND"',
6472
'CPPFLAGS=-DWOLFSSL_NO_CLIENT_AUTH',
6573
'CPPFLAGS=''-DNO_WOLFSSL_CLIENT -DWOLFSSL_NO_CLIENT_AUTH''',
6674
'CPPFLAGS=''-DNO_WOLFSSL_SERVER -DWOLFSSL_NO_CLIENT_AUTH''',

‎configure.ac‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9969,7 +9969,7 @@ fi
99699969
99709970
# Crypto Callbacks Utils (Copy/Free/etc)
99719971
AC_ARG_ENABLE([cryptocbutils],
9972-
[AS_HELP_STRING([--enable-cryptocbutils@<:@=copy,free,...@:>@],
9972+
[AS_HELP_STRING([--enable-cryptocbutils@<:@=copy,free,setkey,export,...@:>@],
99739973
[Enable crypto callback utilities (default: all)])],
99749974
[ ENABLED_CRYPTOCB_UTILS=$enableval ],
99759975
[ ENABLED_CRYPTOCB_UTILS=no ]
@@ -9982,8 +9982,7 @@ if test "$ENABLED_CRYPTOCB_UTILS" != "no"; then
99829982
99839983
if test "$ENABLED_CRYPTOCB_UTILS" = "yes"; then
99849984
# Enable all utilities
9985-
AM_CFLAGS="$AM_CFLAGS -DWOLF_CRYPTO_CB_COPY -DWOLF_CRYPTO_CB_FREE"
9986-
# Future utilities go here when added
9985+
AM_CFLAGS="$AM_CFLAGS -DWOLF_CRYPTO_CB_COPY -DWOLF_CRYPTO_CB_FREE -DWOLF_CRYPTO_CB_SETKEY -DWOLF_CRYPTO_CB_EXPORT_KEY"
99879986
else
99889987
# Parse comma-separated list
99899988
OIFS="$IFS"
@@ -9996,9 +9995,14 @@ if test "$ENABLED_CRYPTOCB_UTILS" != "no"; then
99969995
free)
99979996
AM_CFLAGS="$AM_CFLAGS -DWOLF_CRYPTO_CB_FREE"
99989997
;;
9999-
# Add future options here (e.g., malloc, realloc, etc)
9998+
setkey)
9999+
AM_CFLAGS="$AM_CFLAGS -DWOLF_CRYPTO_CB_SETKEY"
10000+
;;
10001+
export)
10002+
AM_CFLAGS="$AM_CFLAGS -DWOLF_CRYPTO_CB_EXPORT_KEY"
10003+
;;
1000010004
*)
10001-
AC_MSG_ERROR([Unknown cryptocbutils option: $util. Valid options: copy, free])
10005+
AC_MSG_ERROR([Unknown cryptocbutils option: $util. Valid options: copy, free, setkey, export])
1000210006
;;
1000310007
esac
1000410008
done

‎tests/api.c‎

Lines changed: 327 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28130,6 +28130,35 @@ static int test_CryptoCb_Func(int thisDevId, wc_CryptoInfo* info, void* ctx)
2813028130
ret, *info->pk.eccsign.outlen);
2813128131
#endif
2813228132
}
28133+
else if (info->pk.type == WC_PK_TYPE_EC_GET_SIZE) {
28134+
WC_DECLARE_VAR(tmpEcc, ecc_key, 1, NULL);
28135+
WC_ALLOC_VAR(tmpEcc, ecc_key, 1, NULL);
28136+
if (!WC_VAR_OK(tmpEcc)) {
28137+
ret = MEMORY_E;
28138+
}
28139+
else {
28140+
XMEMCPY(tmpEcc, info->pk.ecc_get_size.key, sizeof(ecc_key));
28141+
tmpEcc->devId = INVALID_DEVID;
28142+
*info->pk.ecc_get_size.keySize = wc_ecc_size(tmpEcc);
28143+
WC_FREE_VAR(tmpEcc, NULL);
28144+
ret = 0;
28145+
}
28146+
}
28147+
else if (info->pk.type == WC_PK_TYPE_EC_GET_SIG_SIZE) {
28148+
WC_DECLARE_VAR(tmpEcc, ecc_key, 1, NULL);
28149+
WC_ALLOC_VAR(tmpEcc, ecc_key, 1, NULL);
28150+
if (!WC_VAR_OK(tmpEcc)) {
28151+
ret = MEMORY_E;
28152+
}
28153+
else {
28154+
XMEMCPY(tmpEcc, info->pk.ecc_get_sig_size.key,
28155+
sizeof(ecc_key));
28156+
tmpEcc->devId = INVALID_DEVID;
28157+
*info->pk.ecc_get_sig_size.sigSize = wc_ecc_sig_size(tmpEcc);
28158+
WC_FREE_VAR(tmpEcc, NULL);
28159+
ret = 0;
28160+
}
28161+
}
2813328162
#endif /* HAVE_ECC */
2813428163
#ifdef HAVE_ED25519
2813528164
if (info->pk.type == WC_PK_TYPE_ED25519_SIGN) {
@@ -28462,6 +28491,304 @@ static int test_CryptoCb_Func(int thisDevId, wc_CryptoInfo* info, void* ctx)
2846228491
}
2846328492
}
2846428493
#endif /* WOLF_CRYPTO_CB_FREE */
28494+
#ifdef WOLF_CRYPTO_CB_SETKEY
28495+
else if (info->algo_type == WC_ALGO_TYPE_SETKEY) {
28496+
#ifdef DEBUG_WOLFSSL
28497+
fprintf(stderr, "test_CryptoCb_Func: SetKey Type=%d\n",
28498+
info->setkey.type);
28499+
#endif
28500+
switch (info->setkey.type) {
28501+
#ifndef NO_AES
28502+
case WC_SETKEY_AES:
28503+
{
28504+
Aes* aes = (Aes*)info->setkey.obj;
28505+
aes->devId = INVALID_DEVID;
28506+
ret = wc_AesSetKey(aes,
28507+
(const byte*)info->setkey.key, info->setkey.keySz,
28508+
(const byte*)info->setkey.aux, info->setkey.flags);
28509+
aes->devId = thisDevId;
28510+
break;
28511+
}
28512+
#endif /* !NO_AES */
28513+
#ifndef NO_HMAC
28514+
case WC_SETKEY_HMAC:
28515+
{
28516+
Hmac* hmac = (Hmac*)info->setkey.obj;
28517+
hmac->devId = INVALID_DEVID;
28518+
ret = wc_HmacSetKey(hmac, hmac->macType,
28519+
(const byte*)info->setkey.key, info->setkey.keySz);
28520+
hmac->devId = thisDevId;
28521+
break;
28522+
}
28523+
#endif /* !NO_HMAC */
28524+
#if !defined(NO_RSA) && defined(WOLFSSL_KEY_TO_DER)
28525+
case WC_SETKEY_RSA_PUB:
28526+
{
28527+
RsaKey* rsaObj = (RsaKey*)info->setkey.obj;
28528+
RsaKey* rsaTmp = (RsaKey*)info->setkey.key;
28529+
int derSz;
28530+
word32 idx = 0;
28531+
byte* der = NULL;
28532+
28533+
derSz = wc_RsaPublicKeyDerSize(rsaTmp, 1);
28534+
if (derSz <= 0) { ret = derSz; break; }
28535+
28536+
der = (byte*)XMALLOC(derSz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
28537+
if (der == NULL) { ret = MEMORY_E; break; }
28538+
28539+
derSz = wc_RsaKeyToPublicDer_ex(rsaTmp, der,
28540+
(word32)derSz, 1);
28541+
if (derSz <= 0) {
28542+
XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
28543+
ret = derSz; break;
28544+
}
28545+
28546+
rsaObj->devId = INVALID_DEVID;
28547+
ret = wc_RsaPublicKeyDecode(der, &idx, rsaObj,
28548+
(word32)derSz);
28549+
rsaObj->devId = thisDevId;
28550+
XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
28551+
break;
28552+
}
28553+
case WC_SETKEY_RSA_PRIV:
28554+
{
28555+
RsaKey* rsaObj = (RsaKey*)info->setkey.obj;
28556+
RsaKey* rsaTmp = (RsaKey*)info->setkey.key;
28557+
int derSz;
28558+
word32 idx = 0;
28559+
byte* der = NULL;
28560+
28561+
derSz = wc_RsaKeyToDer(rsaTmp, NULL, 0);
28562+
if (derSz <= 0) { ret = derSz; break; }
28563+
28564+
der = (byte*)XMALLOC(derSz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
28565+
if (der == NULL) { ret = MEMORY_E; break; }
28566+
28567+
derSz = wc_RsaKeyToDer(rsaTmp, der, (word32)derSz);
28568+
if (derSz <= 0) {
28569+
XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
28570+
ret = derSz; break;
28571+
}
28572+
28573+
rsaObj->devId = INVALID_DEVID;
28574+
ret = wc_RsaPrivateKeyDecode(der, &idx, rsaObj,
28575+
(word32)derSz);
28576+
rsaObj->devId = thisDevId;
28577+
XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
28578+
break;
28579+
}
28580+
#endif /* !NO_RSA && WOLFSSL_KEY_TO_DER */
28581+
#if defined(HAVE_ECC) && defined(HAVE_ECC_KEY_EXPORT) && \
28582+
defined(HAVE_ECC_KEY_IMPORT)
28583+
case WC_SETKEY_ECC_PUB:
28584+
{
28585+
ecc_key* eccObj = (ecc_key*)info->setkey.obj;
28586+
ecc_key* eccTmp = (ecc_key*)info->setkey.key;
28587+
word32 bufSz = ECC_BUFSIZE;
28588+
int curveId;
28589+
WC_DECLARE_VAR(buf, byte, ECC_BUFSIZE, NULL);
28590+
WC_ALLOC_VAR(buf, byte, ECC_BUFSIZE, NULL);
28591+
if (!WC_VAR_OK(buf)) {
28592+
ret = MEMORY_E;
28593+
break;
28594+
}
28595+
28596+
ret = wc_ecc_export_x963(eccTmp, buf, &bufSz);
28597+
if (ret != 0) {
28598+
WC_FREE_VAR(buf, NULL);
28599+
break;
28600+
}
28601+
28602+
curveId = wc_ecc_get_curve_id(eccTmp->idx);
28603+
eccObj->devId = INVALID_DEVID;
28604+
ret = wc_ecc_import_x963_ex2(buf, bufSz, eccObj, curveId, 0);
28605+
eccObj->devId = thisDevId;
28606+
28607+
WC_FREE_VAR(buf, NULL);
28608+
break;
28609+
}
28610+
case WC_SETKEY_ECC_PRIV:
28611+
{
28612+
ecc_key* eccObj = (ecc_key*)info->setkey.obj;
28613+
ecc_key* eccTmp = (ecc_key*)info->setkey.key;
28614+
word32 pubSz = ECC_BUFSIZE;
28615+
word32 privSz = MAX_ECC_BYTES;
28616+
byte* pubPtr = NULL;
28617+
int curveId;
28618+
WC_DECLARE_VAR(pubBuf, byte, ECC_BUFSIZE, NULL);
28619+
WC_DECLARE_VAR(privBuf, byte, MAX_ECC_BYTES, NULL);
28620+
WC_ALLOC_VAR(pubBuf, byte, ECC_BUFSIZE, NULL);
28621+
WC_ALLOC_VAR(privBuf, byte, MAX_ECC_BYTES, NULL);
28622+
if (!WC_VAR_OK(pubBuf) || !WC_VAR_OK(privBuf)) {
28623+
WC_FREE_VAR(pubBuf, NULL);
28624+
WC_FREE_VAR(privBuf, NULL);
28625+
ret = MEMORY_E;
28626+
break;
28627+
}
28628+
28629+
/* Export public key from temp (if available) */
28630+
if (eccTmp->type != ECC_PRIVATEKEY_ONLY) {
28631+
ret = wc_ecc_export_x963(eccTmp, pubBuf, &pubSz);
28632+
if (ret != 0) {
28633+
WC_FREE_VAR(pubBuf, NULL);
28634+
WC_FREE_VAR(privBuf, NULL);
28635+
break;
28636+
}
28637+
pubPtr = pubBuf;
28638+
}
28639+
28640+
ret = wc_ecc_export_private_only(eccTmp, privBuf, &privSz);
28641+
if (ret != 0) {
28642+
WC_FREE_VAR(pubBuf, NULL);
28643+
WC_FREE_VAR(privBuf, NULL);
28644+
break;
28645+
}
28646+
28647+
curveId = wc_ecc_get_curve_id(eccTmp->idx);
28648+
eccObj->devId = INVALID_DEVID;
28649+
ret = wc_ecc_import_private_key_ex(privBuf, privSz,
28650+
pubPtr, (pubPtr != NULL) ? pubSz : 0,
28651+
eccObj, curveId);
28652+
eccObj->devId = thisDevId;
28653+
28654+
WC_FREE_VAR(pubBuf, NULL);
28655+
WC_FREE_VAR(privBuf, NULL);
28656+
break;
28657+
}
28658+
#endif /* HAVE_ECC && HAVE_ECC_KEY_EXPORT && HAVE_ECC_KEY_IMPORT */
28659+
default:
28660+
ret = WC_NO_ERR_TRACE(NOT_COMPILED_IN);
28661+
break;
28662+
}
28663+
}
28664+
#endif /* WOLF_CRYPTO_CB_SETKEY */
28665+
#ifdef WOLF_CRYPTO_CB_EXPORT_KEY
28666+
else if (info->algo_type == WC_ALGO_TYPE_EXPORT_KEY) {
28667+
#ifdef DEBUG_WOLFSSL
28668+
fprintf(stderr, "test_CryptoCb_Func: ExportKey Type=%d\n",
28669+
info->export_key.type);
28670+
#endif
28671+
switch (info->export_key.type) {
28672+
#if !defined(NO_RSA) && defined(WOLFSSL_KEY_TO_DER)
28673+
case WC_PK_TYPE_RSA:
28674+
{
28675+
RsaKey* src = (RsaKey*)info->export_key.obj;
28676+
RsaKey* dst = (RsaKey*)info->export_key.out;
28677+
int derSz;
28678+
word32 idx = 0;
28679+
byte* der = NULL;
28680+
28681+
/* Try private key export first, fall back to public */
28682+
derSz = wc_RsaKeyToDer(src, NULL, 0);
28683+
if (derSz > 0) {
28684+
der = (byte*)XMALLOC(derSz, NULL,
28685+
DYNAMIC_TYPE_TMP_BUFFER);
28686+
if (der == NULL) { ret = MEMORY_E; break; }
28687+
derSz = wc_RsaKeyToDer(src, der, (word32)derSz);
28688+
if (derSz > 0) {
28689+
ret = wc_RsaPrivateKeyDecode(der, &idx, dst,
28690+
(word32)derSz);
28691+
}
28692+
else {
28693+
ret = derSz;
28694+
}
28695+
XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
28696+
}
28697+
else {
28698+
/* Public key only */
28699+
derSz = wc_RsaPublicKeyDerSize(src, 1);
28700+
if (derSz <= 0) { ret = derSz; break; }
28701+
der = (byte*)XMALLOC(derSz, NULL,
28702+
DYNAMIC_TYPE_TMP_BUFFER);
28703+
if (der == NULL) { ret = MEMORY_E; break; }
28704+
derSz = wc_RsaKeyToPublicDer_ex(src, der,
28705+
(word32)derSz, 1);
28706+
if (derSz > 0) {
28707+
ret = wc_RsaPublicKeyDecode(der, &idx, dst,
28708+
(word32)derSz);
28709+
}
28710+
else {
28711+
ret = derSz;
28712+
}
28713+
XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
28714+
}
28715+
break;
28716+
}
28717+
#endif /* !NO_RSA && WOLFSSL_KEY_TO_DER */
28718+
#if defined(HAVE_ECC) && defined(HAVE_ECC_KEY_EXPORT) && \
28719+
defined(HAVE_ECC_KEY_IMPORT)
28720+
case WC_PK_TYPE_ECDSA_SIGN: /* ECC key */
28721+
{
28722+
ecc_key* src = (ecc_key*)info->export_key.obj;
28723+
ecc_key* dst = (ecc_key*)info->export_key.out;
28724+
word32 pubSz = ECC_BUFSIZE;
28725+
word32 privSz = MAX_ECC_BYTES;
28726+
byte* pubPtr = NULL;
28727+
int curveId;
28728+
WC_DECLARE_VAR(pubBuf, byte, ECC_BUFSIZE, NULL);
28729+
WC_DECLARE_VAR(privBuf, byte, MAX_ECC_BYTES, NULL);
28730+
WC_ALLOC_VAR(pubBuf, byte, ECC_BUFSIZE, NULL);
28731+
WC_ALLOC_VAR(privBuf, byte, MAX_ECC_BYTES, NULL);
28732+
if (!WC_VAR_OK(pubBuf) || !WC_VAR_OK(privBuf)) {
28733+
WC_FREE_VAR(pubBuf, NULL);
28734+
WC_FREE_VAR(privBuf, NULL);
28735+
ret = MEMORY_E;
28736+
break;
28737+
}
28738+
28739+
/* Use software to export from src - prevent recursion */
28740+
{
28741+
int savedDevId = src->devId;
28742+
src->devId = INVALID_DEVID;
28743+
28744+
/* Export public key if available */
28745+
if (src->type != ECC_PRIVATEKEY_ONLY) {
28746+
ret = wc_ecc_export_x963(src, pubBuf, &pubSz);
28747+
if (ret != 0) {
28748+
src->devId = savedDevId;
28749+
WC_FREE_VAR(pubBuf, NULL);
28750+
WC_FREE_VAR(privBuf, NULL);
28751+
break;
28752+
}
28753+
pubPtr = pubBuf;
28754+
}
28755+
28756+
/* Export private key if available */
28757+
if (src->type != ECC_PUBLICKEY) {
28758+
ret = wc_ecc_export_private_only(src, privBuf,
28759+
&privSz);
28760+
if (ret != 0) {
28761+
src->devId = savedDevId;
28762+
WC_FREE_VAR(pubBuf, NULL);
28763+
WC_FREE_VAR(privBuf, NULL);
28764+
break;
28765+
}
28766+
28767+
curveId = wc_ecc_get_curve_id(src->idx);
28768+
ret = wc_ecc_import_private_key_ex(privBuf, privSz,
28769+
pubPtr, (pubPtr != NULL) ? pubSz : 0,
28770+
dst, curveId);
28771+
}
28772+
else {
28773+
/* Public key only */
28774+
curveId = wc_ecc_get_curve_id(src->idx);
28775+
ret = wc_ecc_import_x963_ex2(pubBuf, pubSz, dst,
28776+
curveId, 0);
28777+
}
28778+
28779+
src->devId = savedDevId;
28780+
}
28781+
WC_FREE_VAR(pubBuf, NULL);
28782+
WC_FREE_VAR(privBuf, NULL);
28783+
break;
28784+
}
28785+
#endif /* HAVE_ECC && HAVE_ECC_KEY_EXPORT && HAVE_ECC_KEY_IMPORT */
28786+
default:
28787+
ret = WC_NO_ERR_TRACE(NOT_COMPILED_IN);
28788+
break;
28789+
}
28790+
}
28791+
#endif /* WOLF_CRYPTO_CB_EXPORT_KEY */
2846528792
(void)thisDevId;
2846628793
(void)keyFormat;
2846728794

0 commit comments

Comments
 (0)