Skip to content

Commit 8199fda

Browse files
dgarskedgarske
authored
Merge pull request #10160 from Roy-Carter/feature/integrate_openssl_comp_fixes
OpenSSL compatibility layer extension
2 parents a3f5260 + eb32554 commit 8199fda

9 files changed

Lines changed: 310 additions & 1 deletion

File tree

‎.codespellexcludelines‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,3 +19,5 @@ rsource "Kconfig.tls-generic"
1919
/* functions added to support above needed, removed TOOM and KARATSUBA */
2020
#include <sys/systm.h>
2121
* extern global version from /usr/src/sys/sys/systm.h */
22+
return "UE";
23+
ExpectStrEQ(wolfSSL_alert_desc_string(unsupported_extension), "UE");

‎src/ssl.c‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12132,12 +12132,96 @@ const char* wolfSSL_alert_type_string_long(int alertID)
1213212132
return AlertTypeToString(alertID);
1213312133
}
1213412134

12135+
const char* wolfSSL_alert_type_string(int alertID)
12136+
{
12137+
WOLFSSL_ENTER("wolfSSL_alert_type_string");
12138+
12139+
switch (alertID) {
12140+
case alert_warning:
12141+
return "W";
12142+
case alert_fatal:
12143+
return "F";
12144+
default:
12145+
return "U";
12146+
}
12147+
}
12148+
1213512149
const char* wolfSSL_alert_desc_string_long(int alertID)
1213612150
{
1213712151
WOLFSSL_ENTER("wolfSSL_alert_desc_string_long");
1213812152

1213912153
return AlertTypeToString(alertID);
1214012154
}
12155+
12156+
const char* wolfSSL_alert_desc_string(int alertID)
12157+
{
12158+
WOLFSSL_ENTER("wolfSSL_alert_desc_string");
12159+
12160+
switch (alertID) {
12161+
case close_notify:
12162+
return "CN";
12163+
case unexpected_message:
12164+
return "UM";
12165+
case bad_record_mac:
12166+
return "BM";
12167+
case record_overflow:
12168+
return "RO";
12169+
case decompression_failure:
12170+
return "DF";
12171+
case handshake_failure:
12172+
return "HF";
12173+
case no_certificate:
12174+
return "NC";
12175+
case bad_certificate:
12176+
return "BC";
12177+
case unsupported_certificate:
12178+
return "UC";
12179+
case certificate_revoked:
12180+
return "CR";
12181+
case certificate_expired:
12182+
return "CE";
12183+
case certificate_unknown:
12184+
return "CU";
12185+
case illegal_parameter:
12186+
return "IP";
12187+
case unknown_ca:
12188+
return "CA";
12189+
case access_denied:
12190+
return "AD";
12191+
case decode_error:
12192+
return "DE";
12193+
case decrypt_error:
12194+
return "DC";
12195+
case wolfssl_alert_protocol_version:
12196+
return "PV";
12197+
case insufficient_security:
12198+
return "IS";
12199+
case internal_error:
12200+
return "IE";
12201+
case inappropriate_fallback:
12202+
return "IF";
12203+
case user_canceled:
12204+
return "US";
12205+
case no_renegotiation:
12206+
return "NR";
12207+
case missing_extension:
12208+
return "ME";
12209+
case unsupported_extension:
12210+
return "UE";
12211+
case unrecognized_name:
12212+
return "UN";
12213+
case bad_certificate_status_response:
12214+
return "BR";
12215+
case unknown_psk_identity:
12216+
return "UP";
12217+
case certificate_required:
12218+
return "CQ";
12219+
case no_application_protocol:
12220+
return "AP";
12221+
default:
12222+
return "UK";
12223+
}
12224+
}
1214112225
#endif /* !NO_TLS */
1214212226

1214312227
#define STATE_STRINGS_PROTO(s) \

‎tests/api/test_evp_pkey.c‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2013,6 +2013,121 @@ int test_wolfSSL_EVP_MD_ecc_signing(void)
20132013
}
20142014

20152015

2016+
int test_wolfSSL_EVP_DigestSign(void)
2017+
{
2018+
EXPECT_DECLS;
2019+
#if defined(OPENSSL_EXTRA) && !defined(NO_RSA) && defined(USE_CERT_BUFFERS_2048)
2020+
WOLFSSL_EVP_PKEY* privKey = NULL;
2021+
WOLFSSL_EVP_PKEY* pubKey = NULL;
2022+
const unsigned char testData[] = "Hi There";
2023+
WOLFSSL_EVP_MD_CTX mdCtx;
2024+
int ret;
2025+
const unsigned char* cp;
2026+
const unsigned char* p;
2027+
unsigned char sig[2048/8];
2028+
size_t sigSz;
2029+
2030+
cp = client_key_der_2048;
2031+
ExpectNotNull((privKey = wolfSSL_d2i_PrivateKey(EVP_PKEY_RSA, NULL, &cp,
2032+
sizeof_client_key_der_2048)));
2033+
p = client_keypub_der_2048;
2034+
ExpectNotNull((pubKey = wolfSSL_d2i_PUBKEY(NULL, &p,
2035+
sizeof_client_keypub_der_2048)));
2036+
2037+
/* One-shot sign: query size first */
2038+
wolfSSL_EVP_MD_CTX_init(&mdCtx);
2039+
ExpectIntEQ(wolfSSL_EVP_DigestSignInit(&mdCtx, NULL, wolfSSL_EVP_sha256(),
2040+
NULL, privKey), 1);
2041+
sigSz = 0;
2042+
ExpectIntEQ(wolfSSL_EVP_DigestSign(&mdCtx, NULL, &sigSz, testData,
2043+
(unsigned int)XSTRLEN((const char*)testData)), 1);
2044+
ExpectIntGT((int)sigSz, 0);
2045+
ret = wolfSSL_EVP_MD_CTX_cleanup(&mdCtx);
2046+
ExpectIntEQ(ret, 1);
2047+
2048+
/* One-shot sign: actually produce the signature */
2049+
wolfSSL_EVP_MD_CTX_init(&mdCtx);
2050+
ExpectIntEQ(wolfSSL_EVP_DigestSignInit(&mdCtx, NULL, wolfSSL_EVP_sha256(),
2051+
NULL, privKey), 1);
2052+
sigSz = sizeof(sig);
2053+
ExpectIntEQ(wolfSSL_EVP_DigestSign(&mdCtx, sig, &sigSz, testData,
2054+
(unsigned int)XSTRLEN((const char*)testData)), 1);
2055+
ExpectIntGT((int)sigSz, 0);
2056+
ret = wolfSSL_EVP_MD_CTX_cleanup(&mdCtx);
2057+
ExpectIntEQ(ret, 1);
2058+
2059+
/* One-shot verify */
2060+
wolfSSL_EVP_MD_CTX_init(&mdCtx);
2061+
ExpectIntEQ(wolfSSL_EVP_DigestVerifyInit(&mdCtx, NULL,
2062+
wolfSSL_EVP_sha256(), NULL, pubKey), 1);
2063+
ExpectIntEQ(wolfSSL_EVP_DigestVerify(&mdCtx, sig, sigSz, testData,
2064+
(unsigned int)XSTRLEN((const char*)testData)), 1);
2065+
ret = wolfSSL_EVP_MD_CTX_cleanup(&mdCtx);
2066+
ExpectIntEQ(ret, 1);
2067+
2068+
/* One-shot sign + verify with NULL ctx should fail */
2069+
ExpectIntEQ(wolfSSL_EVP_DigestSign(NULL, sig, &sigSz, testData,
2070+
(unsigned int)XSTRLEN((const char*)testData)),
2071+
WOLFSSL_FAILURE);
2072+
ExpectIntEQ(wolfSSL_EVP_DigestVerify(NULL, sig, sigSz, testData,
2073+
(unsigned int)XSTRLEN((const char*)testData)),
2074+
WOLFSSL_FAILURE);
2075+
2076+
wolfSSL_EVP_PKEY_free(pubKey);
2077+
wolfSSL_EVP_PKEY_free(privKey);
2078+
#endif
2079+
return EXPECT_RESULT();
2080+
}
2081+
2082+
2083+
int test_wolfSSL_EVP_DigestSign_ecc(void)
2084+
{
2085+
EXPECT_DECLS;
2086+
#if defined(OPENSSL_EXTRA) && defined(HAVE_ECC) && defined(USE_CERT_BUFFERS_256)
2087+
WOLFSSL_EVP_PKEY* privKey = NULL;
2088+
WOLFSSL_EVP_PKEY* pubKey = NULL;
2089+
const unsigned char testData[] = "ECC one-shot test";
2090+
WOLFSSL_EVP_MD_CTX mdCtx;
2091+
int ret;
2092+
const unsigned char* cp;
2093+
const unsigned char* p;
2094+
unsigned char sig[256];
2095+
size_t sigSz;
2096+
2097+
cp = ecc_clikey_der_256;
2098+
ExpectNotNull(privKey = wolfSSL_d2i_PrivateKey(EVP_PKEY_EC, NULL, &cp,
2099+
sizeof_ecc_clikey_der_256));
2100+
p = ecc_clikeypub_der_256;
2101+
ExpectNotNull((pubKey = wolfSSL_d2i_PUBKEY(NULL, &p,
2102+
sizeof_ecc_clikeypub_der_256)));
2103+
2104+
/* One-shot sign */
2105+
wolfSSL_EVP_MD_CTX_init(&mdCtx);
2106+
ExpectIntEQ(wolfSSL_EVP_DigestSignInit(&mdCtx, NULL, wolfSSL_EVP_sha256(),
2107+
NULL, privKey), 1);
2108+
sigSz = sizeof(sig);
2109+
ExpectIntEQ(wolfSSL_EVP_DigestSign(&mdCtx, sig, &sigSz, testData,
2110+
(unsigned int)XSTRLEN((const char*)testData)), 1);
2111+
ExpectIntGT((int)sigSz, 0);
2112+
ret = wolfSSL_EVP_MD_CTX_cleanup(&mdCtx);
2113+
ExpectIntEQ(ret, 1);
2114+
2115+
/* One-shot verify */
2116+
wolfSSL_EVP_MD_CTX_init(&mdCtx);
2117+
ExpectIntEQ(wolfSSL_EVP_DigestVerifyInit(&mdCtx, NULL,
2118+
wolfSSL_EVP_sha256(), NULL, pubKey), 1);
2119+
ExpectIntEQ(wolfSSL_EVP_DigestVerify(&mdCtx, sig, sigSz, testData,
2120+
(unsigned int)XSTRLEN((const char*)testData)), 1);
2121+
ret = wolfSSL_EVP_MD_CTX_cleanup(&mdCtx);
2122+
ExpectIntEQ(ret, 1);
2123+
2124+
wolfSSL_EVP_PKEY_free(pubKey);
2125+
wolfSSL_EVP_PKEY_free(privKey);
2126+
#endif
2127+
return EXPECT_RESULT();
2128+
}
2129+
2130+
20162131
int test_wolfSSL_EVP_PKEY_encrypt(void)
20172132
{
20182133
EXPECT_DECLS;

‎tests/api/test_evp_pkey.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,8 @@ int test_wolfSSL_EVP_PKEY_sign_verify_ec(void);
5858
int test_wolfSSL_EVP_MD_rsa_signing(void);
5959
int test_wc_RsaPSS_DigitalSignVerify(void);
6060
int test_wolfSSL_EVP_MD_ecc_signing(void);
61+
int test_wolfSSL_EVP_DigestSign(void);
62+
int test_wolfSSL_EVP_DigestSign_ecc(void);
6163
int test_wolfSSL_EVP_PKEY_encrypt(void);
6264
int test_wolfSSL_EVP_PKEY_derive(void);
6365
int test_wolfSSL_EVP_PKEY_print_public(void);
@@ -101,6 +103,8 @@ int test_wolfSSL_EVP_PKEY_ed448(void);
101103
TEST_DECL_GROUP("evp_pkey", test_wolfSSL_EVP_MD_rsa_signing), \
102104
TEST_DECL_GROUP("evp_pkey", test_wc_RsaPSS_DigitalSignVerify), \
103105
TEST_DECL_GROUP("evp_pkey", test_wolfSSL_EVP_MD_ecc_signing), \
106+
TEST_DECL_GROUP("evp_pkey", test_wolfSSL_EVP_DigestSign), \
107+
TEST_DECL_GROUP("evp_pkey", test_wolfSSL_EVP_DigestSign_ecc), \
104108
TEST_DECL_GROUP("evp_pkey", test_wolfSSL_EVP_PKEY_encrypt), \
105109
TEST_DECL_GROUP("evp_pkey", test_wolfSSL_EVP_PKEY_derive), \
106110
TEST_DECL_GROUP("evp_pkey", test_wolfSSL_EVP_PKEY_print_public), \

‎tests/api/test_tls.c‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
#include <tests/utils.h>
3232
#include <tests/api/test_tls.h>
3333
#include <wolfssl/internal.h>
34+
#include <wolfssl/ssl.h>
3435

3536

3637
int test_utils_memio_move_message(void)
@@ -1106,6 +1107,19 @@ int test_tls12_corrupted_finished(void)
11061107
return EXPECT_RESULT();
11071108
}
11081109

1110+
int test_wolfSSL_alert_type_string(void)
1111+
{
1112+
EXPECT_DECLS;
1113+
#if !defined(NO_TLS) && defined(OPENSSL_EXTRA)
1114+
ExpectStrEQ(wolfSSL_alert_type_string(alert_warning), "W");
1115+
ExpectStrEQ(wolfSSL_alert_type_string(alert_fatal), "F");
1116+
ExpectStrEQ(wolfSSL_alert_type_string(0), "U");
1117+
ExpectStrEQ(wolfSSL_alert_type_string(-1), "U");
1118+
ExpectStrEQ(wolfSSL_alert_type_string(99), "U");
1119+
#endif
1120+
return EXPECT_RESULT();
1121+
}
1122+
11091123
/* Test the TLS 1.2 peerAuthGood fail-safe checks directly on both sides.
11101124
* The client branch sets NO_PEER_VERIFY; the server branch returns a generic
11111125
* fatal error from TICKET_SENT before sending its Finished. */
@@ -1165,3 +1179,43 @@ int test_tls12_peerauth_failsafe(void)
11651179
#endif
11661180
return EXPECT_RESULT();
11671181
}
1182+
1183+
int test_wolfSSL_alert_desc_string(void)
1184+
{
1185+
EXPECT_DECLS;
1186+
#if !defined(NO_TLS) && defined(OPENSSL_EXTRA)
1187+
ExpectStrEQ(wolfSSL_alert_desc_string(close_notify), "CN");
1188+
ExpectStrEQ(wolfSSL_alert_desc_string(unexpected_message), "UM");
1189+
ExpectStrEQ(wolfSSL_alert_desc_string(bad_record_mac), "BM");
1190+
ExpectStrEQ(wolfSSL_alert_desc_string(record_overflow), "RO");
1191+
ExpectStrEQ(wolfSSL_alert_desc_string(decompression_failure), "DF");
1192+
ExpectStrEQ(wolfSSL_alert_desc_string(handshake_failure), "HF");
1193+
ExpectStrEQ(wolfSSL_alert_desc_string(no_certificate), "NC");
1194+
ExpectStrEQ(wolfSSL_alert_desc_string(bad_certificate), "BC");
1195+
ExpectStrEQ(wolfSSL_alert_desc_string(unsupported_certificate), "UC");
1196+
ExpectStrEQ(wolfSSL_alert_desc_string(certificate_revoked), "CR");
1197+
ExpectStrEQ(wolfSSL_alert_desc_string(certificate_expired), "CE");
1198+
ExpectStrEQ(wolfSSL_alert_desc_string(certificate_unknown), "CU");
1199+
ExpectStrEQ(wolfSSL_alert_desc_string(illegal_parameter), "IP");
1200+
ExpectStrEQ(wolfSSL_alert_desc_string(unknown_ca), "CA");
1201+
ExpectStrEQ(wolfSSL_alert_desc_string(access_denied), "AD");
1202+
ExpectStrEQ(wolfSSL_alert_desc_string(decode_error), "DE");
1203+
ExpectStrEQ(wolfSSL_alert_desc_string(decrypt_error), "DC");
1204+
ExpectStrEQ(wolfSSL_alert_desc_string(wolfssl_alert_protocol_version), "PV");
1205+
ExpectStrEQ(wolfSSL_alert_desc_string(insufficient_security), "IS");
1206+
ExpectStrEQ(wolfSSL_alert_desc_string(internal_error), "IE");
1207+
ExpectStrEQ(wolfSSL_alert_desc_string(inappropriate_fallback), "IF");
1208+
ExpectStrEQ(wolfSSL_alert_desc_string(user_canceled), "US");
1209+
ExpectStrEQ(wolfSSL_alert_desc_string(no_renegotiation), "NR");
1210+
ExpectStrEQ(wolfSSL_alert_desc_string(missing_extension), "ME");
1211+
ExpectStrEQ(wolfSSL_alert_desc_string(unsupported_extension), "UE");
1212+
ExpectStrEQ(wolfSSL_alert_desc_string(unrecognized_name), "UN");
1213+
ExpectStrEQ(wolfSSL_alert_desc_string(bad_certificate_status_response), "BR");
1214+
ExpectStrEQ(wolfSSL_alert_desc_string(unknown_psk_identity), "UP");
1215+
ExpectStrEQ(wolfSSL_alert_desc_string(certificate_required), "CQ");
1216+
ExpectStrEQ(wolfSSL_alert_desc_string(no_application_protocol), "AP");
1217+
/* Unknown alert description returns "UK" */
1218+
ExpectStrEQ(wolfSSL_alert_desc_string(255), "UK");
1219+
#endif
1220+
return EXPECT_RESULT();
1221+
}

‎tests/api/test_tls.h‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,8 @@ int test_tls_set_session_min_downgrade(void);
3636
int test_tls_set_curves_list_ecc_fallback(void);
3737
int test_tls12_corrupted_finished(void);
3838
int test_tls12_peerauth_failsafe(void);
39+
int test_wolfSSL_alert_type_string(void);
40+
int test_wolfSSL_alert_desc_string(void);
3941

4042
#define TEST_TLS_DECLS \
4143
TEST_DECL_GROUP("tls", test_utils_memio_move_message), \
@@ -51,6 +53,8 @@ int test_tls12_peerauth_failsafe(void);
5153
TEST_DECL_GROUP("tls", test_tls_set_session_min_downgrade), \
5254
TEST_DECL_GROUP("tls", test_tls_set_curves_list_ecc_fallback), \
5355
TEST_DECL_GROUP("tls", test_tls12_corrupted_finished), \
54-
TEST_DECL_GROUP("tls", test_tls12_peerauth_failsafe)
56+
TEST_DECL_GROUP("tls", test_tls12_peerauth_failsafe), \
57+
TEST_DECL_GROUP("tls", test_wolfSSL_alert_type_string), \
58+
TEST_DECL_GROUP("tls", test_wolfSSL_alert_desc_string)
5559

5660
#endif /* TESTS_API_TEST_TLS_H */

‎wolfcrypt/src/evp.c‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4974,6 +4974,25 @@ int wolfSSL_EVP_DigestSignFinal(WOLFSSL_EVP_MD_CTX *ctx, unsigned char *sig,
49744974
return ret;
49754975
}
49764976

4977+
int wolfSSL_EVP_DigestSign(WOLFSSL_EVP_MD_CTX *ctx, unsigned char *sigret,
4978+
size_t *siglen, const unsigned char *tbs,
4979+
size_t tbslen)
4980+
{
4981+
WOLFSSL_ENTER("EVP_DigestSign");
4982+
4983+
if (ctx == NULL || siglen == NULL)
4984+
return WOLFSSL_FAILURE;
4985+
4986+
if (sigret != NULL) {
4987+
if (tbs == NULL)
4988+
return WOLFSSL_FAILURE;
4989+
if (wolfSSL_EVP_DigestSignUpdate(ctx, tbs, (unsigned int)tbslen)
4990+
!= WOLFSSL_SUCCESS)
4991+
return WOLFSSL_FAILURE;
4992+
}
4993+
return wolfSSL_EVP_DigestSignFinal(ctx, sigret, siglen);
4994+
}
4995+
49774996
int wolfSSL_EVP_DigestVerifyInit(WOLFSSL_EVP_MD_CTX *ctx,
49784997
WOLFSSL_EVP_PKEY_CTX **pctx,
49794998
const WOLFSSL_EVP_MD *type,
@@ -5070,6 +5089,21 @@ int wolfSSL_EVP_DigestVerifyFinal(WOLFSSL_EVP_MD_CTX *ctx,
50705089
return WOLFSSL_FAILURE;
50715090
}
50725091

5092+
int wolfSSL_EVP_DigestVerify(WOLFSSL_EVP_MD_CTX *ctx,
5093+
const unsigned char *sigret, size_t siglen,
5094+
const unsigned char *tbs, size_t tbslen)
5095+
{
5096+
WOLFSSL_ENTER("EVP_DigestVerify");
5097+
5098+
if (ctx == NULL || sigret == NULL || tbs == NULL)
5099+
return WOLFSSL_FAILURE;
5100+
5101+
if (wolfSSL_EVP_DigestVerifyUpdate(ctx, tbs, tbslen) != WOLFSSL_SUCCESS)
5102+
return WOLFSSL_FAILURE;
5103+
5104+
return wolfSSL_EVP_DigestVerifyFinal(ctx, sigret, siglen);
5105+
}
5106+
50735107

50745108
#ifdef WOLFSSL_APACHE_HTTPD
50755109
#if !defined(USE_WINDOWS_API) && !defined(MICROCHIP_PIC32)

0 commit comments

Comments
 (0)