add aesCmac support to libipcrypto (required by iptcp) (taken from vx6.9 code base) (#14)
The libipcrypto library was ported from VxWorks 7 to use the OpenSSL 3.1.7. (to be 3.5.0 later) This did not have aesCmac support that was required by iptcp. Hence these files are brought from the VxWorks 6.9 (ip_net2-6.9/ipcrypto/src) code base. Reviewed-on: http://13.234.246.121:3000/Neominds/ossl35vx69/pulls/14 Co-authored-by: siddhant <siddhant.singh@neominds.in> Co-committed-by: siddhant <siddhant.singh@neominds.in>
This commit is contained in:
neelimap
@@ -54,6 +54,8 @@ endif
|
|||||||
endif # ifneq ($(SPACE),user)
|
endif # ifneq ($(SPACE),user)
|
||||||
OBJS += ipcrypto_util.o
|
OBJS += ipcrypto_util.o
|
||||||
OBJS += ipcrypto.o
|
OBJS += ipcrypto.o
|
||||||
|
OBJS += ipcrypto_aescmac.o
|
||||||
|
OBJS += ipcrypto_start.o
|
||||||
|
|
||||||
include $(WIND_BASE)/target/h/make/rules.library
|
include $(WIND_BASE)/target/h/make/rules.library
|
||||||
|
|
||||||
|
|||||||
@@ -0,0 +1,399 @@
|
|||||||
|
/*
|
||||||
|
****************************************************************************
|
||||||
|
* 1 DESCRIPTION
|
||||||
|
****************************************************************************
|
||||||
|
This file implements AES-CMAC as per RFC4493 and AES-CMAC-PRF-128 (RFC 4615)
|
||||||
|
*/
|
||||||
|
|
||||||
|
/*
|
||||||
|
****************************************************************************
|
||||||
|
* 2 CONFIGURATION
|
||||||
|
****************************************************************************
|
||||||
|
*/
|
||||||
|
|
||||||
|
#define INCLUDE_AES_CMAC_TESTS
|
||||||
|
|
||||||
|
|
||||||
|
/*
|
||||||
|
****************************************************************************
|
||||||
|
* 3 INCLUDE FILES
|
||||||
|
****************************************************************************
|
||||||
|
*/
|
||||||
|
|
||||||
|
#include <ipcom_type.h>
|
||||||
|
#include <openssl/aes.h>
|
||||||
|
#include <string.h>
|
||||||
|
#include <stdio.h>
|
||||||
|
#include <stdlib.h>
|
||||||
|
#include <sys/types.h>
|
||||||
|
#include <ipcom_syslog.h>
|
||||||
|
#include "ipcrypto.h"
|
||||||
|
#include "ipcrypto_h.h"
|
||||||
|
|
||||||
|
|
||||||
|
/*
|
||||||
|
****************************************************************************
|
||||||
|
* 4 EXTERN PROTOTYPES
|
||||||
|
****************************************************************************
|
||||||
|
*/
|
||||||
|
|
||||||
|
|
||||||
|
/*
|
||||||
|
****************************************************************************
|
||||||
|
* 5 DEFINES
|
||||||
|
****************************************************************************
|
||||||
|
*/
|
||||||
|
|
||||||
|
#ifdef __GNUC__
|
||||||
|
#ifndef alloca
|
||||||
|
#define alloca __builtin_alloca
|
||||||
|
#endif
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#define _XOR_BLOCK(out, in1, in2) {int i;for( i = 0; i < AES_BLOCKSIZE; i++ ) out[i] = in1[i] ^ in2[i];}
|
||||||
|
#define CMAC_SHIFT_LEFT(in, out) {int n; Ip_u8 oflow = 0; for(n=15;n>=0;n--) { \
|
||||||
|
out[n] = in[n] << 1; out[n] |= oflow; \
|
||||||
|
oflow = (in[n] & 0x80) ? 1 : 0; }}
|
||||||
|
|
||||||
|
/*
|
||||||
|
****************************************************************************
|
||||||
|
* 6 TYPES
|
||||||
|
****************************************************************************
|
||||||
|
*/
|
||||||
|
|
||||||
|
typedef struct _AES_CMAC_CONTEXT
|
||||||
|
{
|
||||||
|
Ip_u8 IV[AES_BLOCKSIZE]; /* IV initialization vector */
|
||||||
|
Ip_u32 ivLength; /* IV length */
|
||||||
|
Ip_u8 k1[AES_BLOCKSIZE]; /* k1 subkey */
|
||||||
|
Ip_u8 k2[AES_BLOCKSIZE]; /* k2 subkey */
|
||||||
|
AES_KEY aesKey; /* AES_KEY used for cipher */
|
||||||
|
} AES_CMAC_CTX;
|
||||||
|
|
||||||
|
/*
|
||||||
|
****************************************************************************
|
||||||
|
* 7 LOCAL PROTOTYPES
|
||||||
|
****************************************************************************
|
||||||
|
*/
|
||||||
|
|
||||||
|
|
||||||
|
/*
|
||||||
|
****************************************************************************
|
||||||
|
* 8 DATA
|
||||||
|
****************************************************************************
|
||||||
|
*/
|
||||||
|
|
||||||
|
|
||||||
|
/*
|
||||||
|
****************************************************************************
|
||||||
|
* 9 LOCAL FUNCTIONS
|
||||||
|
****************************************************************************
|
||||||
|
*/
|
||||||
|
|
||||||
|
|
||||||
|
/*
|
||||||
|
*===========================================================================
|
||||||
|
* aesCmacGenerateSubKeys
|
||||||
|
*===========================================================================
|
||||||
|
* Description: Generates the two CMAC subkeys given an AES 128 bit key
|
||||||
|
* Parameters: cmacCtx - pointer to AES_CMAC_CTX. k1 and k2 and aesKey are returned via this pointer
|
||||||
|
* key - pointer to the key buffer
|
||||||
|
* keyLengthBits - length of the key in bits
|
||||||
|
* Modify
|
||||||
|
* < cmacCtx->k1 > - K1 (128-bit first subkey)
|
||||||
|
* < cmacCtx->k2 > - K2 (128-bit first subkey)
|
||||||
|
*
|
||||||
|
* Constants: const_Zero is 0x00000000000000000000000000000000
|
||||||
|
* const_Rb is 0x00000000000000000000000000000087
|
||||||
|
*
|
||||||
|
* Variables: L for output of AES-128 applied to 0^128
|
||||||
|
*
|
||||||
|
* Step 1. L <- AES-128(K, const_Zero);
|
||||||
|
* Step 2. if MSB(L) is equal to 0
|
||||||
|
* K1 <- L << 1;
|
||||||
|
* else
|
||||||
|
* K1 <- (L << 1) XOR const_Rb;
|
||||||
|
* Step 3. if MSB(K1) is equal to 0
|
||||||
|
* K2 <- K1 << 1;
|
||||||
|
* else
|
||||||
|
* K2 <- (K1 << 1) XOR const_Rb;
|
||||||
|
* Step 4. return K1, K2;
|
||||||
|
*
|
||||||
|
* Returns: 1 if success
|
||||||
|
* -1 if failure
|
||||||
|
*
|
||||||
|
*/
|
||||||
|
static int aesCmacGenerateSubKeys(AES_CMAC_CTX *cmacCtx,Ip_u8 *key, unsigned int keyLengthBits){
|
||||||
|
|
||||||
|
Ip_u8 L[16],
|
||||||
|
Z[16],
|
||||||
|
IV[16],
|
||||||
|
tmp[16],
|
||||||
|
const_Rb[16] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||||
|
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x87 };
|
||||||
|
|
||||||
|
ipcom_memset( Z, 0, 16 );
|
||||||
|
ipcom_memset( L, 0, 16 );
|
||||||
|
ipcom_memset( IV, 0, 16 );
|
||||||
|
ipcom_memset( cmacCtx->k1, 0, 16 );
|
||||||
|
ipcom_memset( cmacCtx->k2, 0, 16 );
|
||||||
|
ipcom_memset( cmacCtx->IV, 0, AES_BLOCKSIZE );
|
||||||
|
|
||||||
|
|
||||||
|
if ( -1 == AES_set_encrypt_key(key, keyLengthBits, &cmacCtx->aesKey)) {
|
||||||
|
/*IPCOM_LOG0(ERR,"AES_set_encrypt_key failed");*/
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
|
AES_ecb_encrypt(Z, L,&cmacCtx->aesKey, AES_ENCRYPT);
|
||||||
|
|
||||||
|
if ( ( L[0] & 0x80 ) == 0 ) { /* If MSB(L) == 0, K1 = L << 1 */
|
||||||
|
CMAC_SHIFT_LEFT( L, cmacCtx->k1 );
|
||||||
|
} else { /* if MSB(L) != 0, K1 = ( L << 1 ) (+) Rb */
|
||||||
|
CMAC_SHIFT_LEFT( L, tmp );
|
||||||
|
_XOR_BLOCK( cmacCtx->k1, tmp, const_Rb );
|
||||||
|
}
|
||||||
|
if ( ( cmacCtx->k1[0] & 0x80 ) == 0 ) {
|
||||||
|
CMAC_SHIFT_LEFT( cmacCtx->k1, cmacCtx->k2 );
|
||||||
|
} else {
|
||||||
|
CMAC_SHIFT_LEFT( cmacCtx->k1, tmp );
|
||||||
|
_XOR_BLOCK( cmacCtx->k2, tmp, const_Rb );
|
||||||
|
}
|
||||||
|
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
/*
|
||||||
|
****************************************************************************
|
||||||
|
* 10 PUBLIC FUNCTIONS
|
||||||
|
****************************************************************************
|
||||||
|
*/
|
||||||
|
/*
|
||||||
|
*===========================================================================
|
||||||
|
* aesCmacPrf128
|
||||||
|
*===========================================================================
|
||||||
|
* Description: Implements RFC 4615 for IKEv2
|
||||||
|
* Parameters: key - buffer pointing to the variable length key
|
||||||
|
* keyLength - length of key
|
||||||
|
* input - pointer to buffer with input message
|
||||||
|
* inputLength - length of input buffer
|
||||||
|
* output - pointer to buffer to copy the output to
|
||||||
|
* outputLength - pointer to length of output buffer. On input, *outputMacLength must be at least AES_BLOCKSIZE.
|
||||||
|
* - on output the length is updated to the actual length of data copied to the output buffer
|
||||||
|
* Returns: 1 if success
|
||||||
|
* -1 if any error
|
||||||
|
*
|
||||||
|
*/
|
||||||
|
IP_EXTERN int aesCmacPrf128(Ip_u8 *key, int keyLength, Ip_u8 *input, int inputLength, Ip_u8 *output, int *outputLength)
|
||||||
|
{
|
||||||
|
Ip_u8 fixedKey[AES_BLOCKSIZE];
|
||||||
|
Ip_u8 zerosKey[AES_BLOCKSIZE];
|
||||||
|
int fixedKeyLength = AES_BLOCKSIZE;
|
||||||
|
|
||||||
|
if (keyLength != 16)
|
||||||
|
{
|
||||||
|
ipcom_memset(zerosKey,0,AES_BLOCKSIZE);
|
||||||
|
aesCmacBlock(NULL,zerosKey,AES_BLOCKSIZE, key,keyLength, fixedKey,&fixedKeyLength); /* use CMAC to reduce key to 128 bits */
|
||||||
|
key = fixedKey;
|
||||||
|
keyLength = fixedKeyLength;
|
||||||
|
}
|
||||||
|
return aesCmacBlock(NULL,key,keyLength, input,inputLength,output,outputLength);
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
*===========================================================================
|
||||||
|
* aesCmacBlock
|
||||||
|
*===========================================================================
|
||||||
|
* Description: Calculates AES-CMAC on a complete input buffer
|
||||||
|
* Parameters: cmacCTx - if NULL - no subkeys are returned
|
||||||
|
* - if !NULL and key != NULL, then the subkeys are calculated and returned in cmacCtx
|
||||||
|
* - if !NULL and key==NULL, then the subkeys from cmacCtx are used (saving a recalculation)
|
||||||
|
* key - buffer pointing to the variable length key
|
||||||
|
* keyLength - length of key
|
||||||
|
* input - pointer to buffer with input message
|
||||||
|
* inputLength - length of input buffer
|
||||||
|
* output - pointer to buffer to copy the output to
|
||||||
|
* outputMacLength - pointer to length of output buffer. On input, *outputMacLength must be at least AES_BLOCKSIZE.
|
||||||
|
* - on output the length is updated to the actual length of data copied to the output buffer
|
||||||
|
* Returns: 1 if success
|
||||||
|
* -1 if any error
|
||||||
|
*
|
||||||
|
*/
|
||||||
|
IP_EXTERN int aesCmacBlock( AES_CMAC_CTX *cmacCtx,Ip_u8 *key,int keyLength, Ip_u8 *input,int inputLength, Ip_u8 *outputMac,int *outputMacLength)
|
||||||
|
{
|
||||||
|
if (cmacCtx == NULL)
|
||||||
|
{
|
||||||
|
cmacCtx = alloca(sizeof(AES_CMAC_CTX));
|
||||||
|
}
|
||||||
|
if (-1 == aesCmacInit(cmacCtx, key, keyLength))
|
||||||
|
{
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
return aesCmacFinal(cmacCtx,input,inputLength,outputMac,outputMacLength);
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
*===========================================================================
|
||||||
|
* aesCmacInit
|
||||||
|
*===========================================================================
|
||||||
|
* Description: Initialize a AES_CMAC_CTX.
|
||||||
|
* Parameters: cmacCtx - pointer to AES_CMAC_CTX to be updated
|
||||||
|
* key - pointer to key buffer. If key == NULL, then the AES_CMAC_CTX subkeys are reused.
|
||||||
|
* keyLength - length of key (bytes)
|
||||||
|
* Returns: 1 on success
|
||||||
|
* -1 on error
|
||||||
|
*
|
||||||
|
*/
|
||||||
|
IP_EXTERN int aesCmacInit( AES_CMAC_CTX *cmacCtx, Ip_u8 *key, int keyLength )
|
||||||
|
{
|
||||||
|
|
||||||
|
/* validate that we either have a key, or a context */
|
||||||
|
AES_CMAC_CTX *pCmacCtx = cmacCtx;
|
||||||
|
Ip_u8 *pKey = key;
|
||||||
|
|
||||||
|
if ( NULL == pCmacCtx && NULL == key)
|
||||||
|
{
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (NULL == pCmacCtx)
|
||||||
|
{
|
||||||
|
/*IPCOM_LOG0(ERR,"aesCmacInit fails, no AES_CMAC_CTX");*/
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (NULL != key)
|
||||||
|
{
|
||||||
|
aesCmacGenerateSubKeys(pCmacCtx,pKey, keyLength <<3);
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
/* setup the rest of context */
|
||||||
|
|
||||||
|
pCmacCtx->ivLength = AES_BLOCKSIZE;
|
||||||
|
ipcom_memset(pCmacCtx->IV,0,AES_BLOCKSIZE);
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
*===========================================================================
|
||||||
|
* aesCmacUpdate
|
||||||
|
*===========================================================================
|
||||||
|
* Description: Add more data to the CMAC. Can be called repeatedly with chunks of the message to be authenticated
|
||||||
|
* Parameters: cmacCTx - pointer to AES_CMAC_CTX that has been initialized via aesCmacInit
|
||||||
|
* key - buffer pointint to the variable length key
|
||||||
|
* keyLength - length of key
|
||||||
|
* input - pointer to buffer with input message
|
||||||
|
* inputLength - length of input buffer. Must be a multiple of AES_BLOCKSIZE
|
||||||
|
* Returns:
|
||||||
|
*
|
||||||
|
*
|
||||||
|
*/
|
||||||
|
IP_EXTERN int aesCmacUpdate(AES_CMAC_CTX *cmacCtx, Ip_u8 * input, Ip_u8 inputLength )
|
||||||
|
{
|
||||||
|
/* inputLength must be multiple of the blocksize */
|
||||||
|
Ip_u8 *out = alloca(sizeof(Ip_u8 ) * inputLength);
|
||||||
|
|
||||||
|
if (inputLength % AES_BLOCKSIZE==0)
|
||||||
|
{
|
||||||
|
AES_cbc_encrypt(input, out, inputLength, &cmacCtx->aesKey,cmacCtx->IV, AES_ENCRYPT);
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
/*IPCOM_LOG0(ERR,"aesCmacUpdate, inputLength is not a multiple of the blocksize");*/
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
*===========================================================================
|
||||||
|
* aesCmacFinal
|
||||||
|
*===========================================================================
|
||||||
|
* Description: Calculates AES-CMAC on a complete input buffer
|
||||||
|
* Parameters: cmacCtx - pointer to AES_CMAC_CTX that has been initialized via aesCmacInit
|
||||||
|
* input - pointer to buffer with input message
|
||||||
|
* inputLength - length of input buffer
|
||||||
|
* pMac - pointer to buffer to copy the output MAC to
|
||||||
|
* poutputMacLength - pointer to length of output buffer. On input, *outputMacLength must be at least AES_BLOCKSIZE.
|
||||||
|
* - on output the length is updated to the actual length of data copied to the output buffer
|
||||||
|
* Returns: 1 if success
|
||||||
|
* -1 if any error
|
||||||
|
*/
|
||||||
|
IP_EXTERN int aesCmacFinal(AES_CMAC_CTX *cmacCtx, Ip_u8 *input, int inputLength,Ip_u8 *pMac,
|
||||||
|
int *pOutputMacLength)
|
||||||
|
{
|
||||||
|
Ip_u8 mlast[AES_BLOCKSIZE], Y[AES_BLOCKSIZE], IV[AES_BLOCKSIZE], *pMn;
|
||||||
|
int mlastLength,updateLength;
|
||||||
|
|
||||||
|
|
||||||
|
if (*pOutputMacLength < AES_BLOCKSIZE)
|
||||||
|
{
|
||||||
|
/*IPCOM_LOG0(ERR,"aesCmacFinal fails pMac buffer too small");*/
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
if (inputLength)
|
||||||
|
{
|
||||||
|
mlastLength = inputLength % AES_BLOCKSIZE;
|
||||||
|
if (mlastLength == 0)
|
||||||
|
{
|
||||||
|
mlastLength = AES_BLOCKSIZE;
|
||||||
|
}
|
||||||
|
updateLength = inputLength - mlastLength;
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
/* a zero length message is a valid concept */
|
||||||
|
mlastLength = 0;
|
||||||
|
updateLength = 0;
|
||||||
|
}
|
||||||
|
pMn = &input[updateLength];
|
||||||
|
|
||||||
|
/*
|
||||||
|
** ---- process all but the last block
|
||||||
|
*/
|
||||||
|
if (updateLength)
|
||||||
|
{
|
||||||
|
aesCmacUpdate(cmacCtx, input, updateLength );
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
** ---- create M_last (using k1 or k2).
|
||||||
|
*/
|
||||||
|
if ( mlastLength == AES_BLOCKSIZE )
|
||||||
|
{
|
||||||
|
_XOR_BLOCK( mlast, cmacCtx->k1, pMn ); /* full block - M_last <- K1 XOR M_n; */
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
ipcom_memset(Y, 0, AES_BLOCKSIZE); /* part block - M_last <- padding(M_n) XOR K2 */
|
||||||
|
ipcom_memcpy(Y, pMn, mlastLength);
|
||||||
|
Y[mlastLength] |= 0x80;
|
||||||
|
_XOR_BLOCK( mlast, cmacCtx->k2, Y );
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
** ---- process M_last to get the MAC into the output buffer
|
||||||
|
*/
|
||||||
|
|
||||||
|
ipcom_memset (IV, 0, sizeof (IV));
|
||||||
|
_XOR_BLOCK( Y, mlast, cmacCtx->IV ); /* Y <- M_last XOR X out,in,in */
|
||||||
|
AES_ecb_encrypt(Y,pMac, &cmacCtx->aesKey,AES_ENCRYPT);
|
||||||
|
*pOutputMacLength = AES_BLOCKSIZE;
|
||||||
|
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
/*
|
||||||
|
****************************************************************************
|
||||||
|
* END OF FILE
|
||||||
|
****************************************************************************
|
||||||
|
*/
|
||||||
|
|
||||||
|
|
||||||
@@ -0,0 +1,94 @@
|
|||||||
|
/*
|
||||||
|
******************************************************************************
|
||||||
|
* INTERPEAK INTERNAL API HEADER FILE
|
||||||
|
*
|
||||||
|
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipcrypto_h.h,v $ $Revision: 1.2 $
|
||||||
|
* $Source: /home/interpeak/CVSRoot/ipcrypto/src/ipcrypto_h.h,v $
|
||||||
|
* $Author: roger $ $Date: 2007-05-11 07:50:07 $
|
||||||
|
* $State: Exp $ $Locker: $
|
||||||
|
*
|
||||||
|
* Copyright Interpeak AB 2000-2003 <www.interpeak.se>. All rights reserved.
|
||||||
|
* Design and implementation by Roger Boden <roger@interpeak.se>
|
||||||
|
******************************************************************************
|
||||||
|
*/
|
||||||
|
#ifndef IPCRYPTO_H_H
|
||||||
|
#define IPCRYPTO_H_H
|
||||||
|
|
||||||
|
/*
|
||||||
|
****************************************************************************
|
||||||
|
* 1 DESCRIPTION
|
||||||
|
****************************************************************************
|
||||||
|
*/
|
||||||
|
|
||||||
|
/*
|
||||||
|
****************************************************************************
|
||||||
|
* 2 CONFIGURATION
|
||||||
|
****************************************************************************
|
||||||
|
*/
|
||||||
|
|
||||||
|
#include <ipcrypto_config.h>
|
||||||
|
|
||||||
|
|
||||||
|
/*
|
||||||
|
****************************************************************************
|
||||||
|
* 3 INCLUDE FILES
|
||||||
|
****************************************************************************
|
||||||
|
*/
|
||||||
|
|
||||||
|
#include <ipcom_type.h>
|
||||||
|
#include <ipcom_cstyle.h>
|
||||||
|
#include <ipcom_os.h>
|
||||||
|
|
||||||
|
|
||||||
|
#ifdef __cplusplus
|
||||||
|
extern "C" {
|
||||||
|
#endif
|
||||||
|
|
||||||
|
/*
|
||||||
|
****************************************************************************
|
||||||
|
* 4 DEFINES
|
||||||
|
****************************************************************************
|
||||||
|
*/
|
||||||
|
|
||||||
|
/*
|
||||||
|
*===========================================================================
|
||||||
|
* syslog
|
||||||
|
*===========================================================================
|
||||||
|
*/
|
||||||
|
#define IPCOM_SYSLOG_PRIORITY IPCRYPTO_SYSLOG_PRIORITY
|
||||||
|
#define IPCOM_SYSLOG_FACILITY IPCOM_LOG_IPCRYPTO
|
||||||
|
|
||||||
|
|
||||||
|
/*
|
||||||
|
****************************************************************************
|
||||||
|
* 5 TYPES
|
||||||
|
****************************************************************************
|
||||||
|
*/
|
||||||
|
|
||||||
|
struct Ipcrypto_data_st
|
||||||
|
{
|
||||||
|
Ipcom_mutex* crypto_locks;
|
||||||
|
};
|
||||||
|
|
||||||
|
typedef struct Ipcrypto_data_st Ipcrypto_data;
|
||||||
|
|
||||||
|
IP_EXTERN Ipcrypto_data ipcrypto;
|
||||||
|
|
||||||
|
/*
|
||||||
|
****************************************************************************
|
||||||
|
* 6 FUNCTIONS
|
||||||
|
****************************************************************************
|
||||||
|
*/
|
||||||
|
|
||||||
|
|
||||||
|
#ifdef __cplusplus
|
||||||
|
}
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
|
/*
|
||||||
|
****************************************************************************
|
||||||
|
* END OF FILE
|
||||||
|
****************************************************************************
|
||||||
|
*/
|
||||||
@@ -0,0 +1,399 @@
|
|||||||
|
/*
|
||||||
|
******************************************************************************
|
||||||
|
* INTERPEAK SOURCE FILE
|
||||||
|
*
|
||||||
|
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipcrypto.c,v $ $Revision: 1.26 $
|
||||||
|
* $Source: /home/interpeak/CVSRoot/ipcrypto/src/ipcrypto.c,v $
|
||||||
|
* $Author: rboden $
|
||||||
|
* $State: Exp $ $Locker: $
|
||||||
|
*
|
||||||
|
* INTERPEAK_COPYRIGHT_STRING
|
||||||
|
* Design and implementation by Roger Boden <roger@interpeak.se>
|
||||||
|
******************************************************************************
|
||||||
|
*/
|
||||||
|
|
||||||
|
/*
|
||||||
|
****************************************************************************
|
||||||
|
* 1 DESCRIPTION
|
||||||
|
****************************************************************************
|
||||||
|
*/
|
||||||
|
|
||||||
|
/*
|
||||||
|
****************************************************************************
|
||||||
|
* 2 CONFIGURATION
|
||||||
|
****************************************************************************
|
||||||
|
*/
|
||||||
|
|
||||||
|
#ifdef IPCOM_DMALLOC_C
|
||||||
|
#undef IPCOM_DMALLOC_C
|
||||||
|
#endif
|
||||||
|
|
||||||
|
|
||||||
|
/*
|
||||||
|
****************************************************************************
|
||||||
|
* 3 INCLUDE FILES
|
||||||
|
****************************************************************************
|
||||||
|
*/
|
||||||
|
|
||||||
|
#define IPCOM_USE_CLIB_PROTO
|
||||||
|
|
||||||
|
#include <ipcom_type.h>
|
||||||
|
#include <ipcom_err.h>
|
||||||
|
#include <ipcom_cstyle.h>
|
||||||
|
#include <openssl/crypto.h>
|
||||||
|
#include <openssl/err.h>
|
||||||
|
#include <openssl/rand.h>
|
||||||
|
|
||||||
|
#include "ipcrypto_start.h"
|
||||||
|
#include "ipcrypto.h"
|
||||||
|
#include "ipcrypto_util.h"
|
||||||
|
#include "ipcrypto_config.h"
|
||||||
|
|
||||||
|
/*
|
||||||
|
****************************************************************************
|
||||||
|
* 4 EXTERN PROTOTYPES
|
||||||
|
****************************************************************************
|
||||||
|
*/
|
||||||
|
|
||||||
|
#ifdef OPENSSL_FIPS
|
||||||
|
unsigned int FIPS_incore_fingerprint(unsigned char *sig,unsigned int len);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
/*
|
||||||
|
****************************************************************************
|
||||||
|
* 5 DEFINES
|
||||||
|
****************************************************************************
|
||||||
|
*/
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
/*
|
||||||
|
****************************************************************************
|
||||||
|
* 6 TYPES
|
||||||
|
****************************************************************************
|
||||||
|
*/
|
||||||
|
|
||||||
|
/*
|
||||||
|
****************************************************************************
|
||||||
|
* 7 LOCAL PROTOTYPES
|
||||||
|
****************************************************************************
|
||||||
|
*/
|
||||||
|
|
||||||
|
IP_PUBLIC const char *ipcrypto_version(void);
|
||||||
|
|
||||||
|
IP_STATIC void ipcrypto_lock_callback(int mode, int type, const char* file, int line);
|
||||||
|
|
||||||
|
IPCOM_PROCESS(ipcrypto_rnd_seed);
|
||||||
|
|
||||||
|
IP_GLOBAL int ipcrypto_cmd_memory(int argc, char **argv);
|
||||||
|
|
||||||
|
IP_PUBLIC void ipcrypto_cmds_startup(void);
|
||||||
|
|
||||||
|
IP_PUBLIC Ip_err ipcrypto_create(void);
|
||||||
|
|
||||||
|
IP_PUBLIC Ip_err ipcrypto_start(void);
|
||||||
|
|
||||||
|
void OPENSSL_init(void);
|
||||||
|
|
||||||
|
/*
|
||||||
|
****************************************************************************
|
||||||
|
* 8 DATA
|
||||||
|
****************************************************************************
|
||||||
|
*/
|
||||||
|
|
||||||
|
#ifndef IP_PORT_LAS
|
||||||
|
extern BIO *bio_err;
|
||||||
|
#endif
|
||||||
|
extern char *default_config_file;
|
||||||
|
Ipcrypto_data ipcrypto;
|
||||||
|
|
||||||
|
|
||||||
|
#ifdef OPENSSL_FIPS
|
||||||
|
extern unsigned char FIPS_signature[20];
|
||||||
|
extern unsigned char ipcrypto_fips_signature[20];
|
||||||
|
#endif
|
||||||
|
|
||||||
|
/*
|
||||||
|
****************************************************************************
|
||||||
|
* 9 LOCAL FUNCTIONS
|
||||||
|
****************************************************************************
|
||||||
|
*/
|
||||||
|
|
||||||
|
/*
|
||||||
|
*===========================================================================
|
||||||
|
* ipcrypto_setup_lock_functions
|
||||||
|
*===========================================================================
|
||||||
|
* Description:
|
||||||
|
* Parameters:
|
||||||
|
* Returns:
|
||||||
|
*
|
||||||
|
*/
|
||||||
|
IP_STATIC Ip_err
|
||||||
|
ipcrypto_setup_lock_functions(void)
|
||||||
|
{
|
||||||
|
int i;
|
||||||
|
|
||||||
|
ipcrypto.crypto_locks = ipcom_malloc(sizeof(Ipcom_mutex)*CRYPTO_NUM_LOCKS);
|
||||||
|
if(!ipcrypto.crypto_locks)
|
||||||
|
return IPCOM_ERR_FAILED;
|
||||||
|
|
||||||
|
for(i=0; i<CRYPTO_NUM_LOCKS; i++)
|
||||||
|
{
|
||||||
|
if(ipcom_mutex_create(&(ipcrypto.crypto_locks[i])) != IPCOM_SUCCESS)
|
||||||
|
{
|
||||||
|
while(i>0)
|
||||||
|
{
|
||||||
|
ipcom_mutex_delete(&(ipcrypto.crypto_locks[i]));
|
||||||
|
i--;
|
||||||
|
}
|
||||||
|
return IPCOM_ERR_FAILED;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
CRYPTO_set_locking_callback(ipcrypto_lock_callback);
|
||||||
|
|
||||||
|
return IPCOM_SUCCESS;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
/*
|
||||||
|
*===========================================================================
|
||||||
|
* ipcrypto_lock_callback
|
||||||
|
*===========================================================================
|
||||||
|
* Description:
|
||||||
|
* Parameters:
|
||||||
|
* Returns:
|
||||||
|
*
|
||||||
|
*/
|
||||||
|
IP_STATIC void
|
||||||
|
ipcrypto_lock_callback(int mode, int type, const char *file, int line)
|
||||||
|
{
|
||||||
|
(void)file;
|
||||||
|
(void)line;
|
||||||
|
|
||||||
|
ip_assert(type < CRYPTO_NUM_LOCKS);
|
||||||
|
ip_assert((mode & CRYPTO_LOCK) || (mode & CRYPTO_UNLOCK));
|
||||||
|
|
||||||
|
if(type >= CRYPTO_NUM_LOCKS)
|
||||||
|
return;
|
||||||
|
|
||||||
|
if(mode & CRYPTO_UNLOCK)
|
||||||
|
{
|
||||||
|
ipcom_mutex_unlock(ipcrypto.crypto_locks[type]);
|
||||||
|
}
|
||||||
|
|
||||||
|
if(mode & CRYPTO_LOCK)
|
||||||
|
{
|
||||||
|
ipcom_mutex_lock(ipcrypto.crypto_locks[type]);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
/*
|
||||||
|
*===========================================================================
|
||||||
|
* ipcrypto_rnd_seed
|
||||||
|
*===========================================================================
|
||||||
|
* Description:
|
||||||
|
* Parameters:
|
||||||
|
* Returns:
|
||||||
|
*
|
||||||
|
*/
|
||||||
|
IPCOM_PROCESS(ipcrypto_rnd_seed)
|
||||||
|
{
|
||||||
|
Ip_u32 i, tmp;
|
||||||
|
|
||||||
|
ipcom_proc_init();
|
||||||
|
|
||||||
|
while(ipcom_random_seed_state() != 100)
|
||||||
|
{
|
||||||
|
tmp = ipcom_random();
|
||||||
|
RAND_seed((char *) &tmp, 4);
|
||||||
|
ipcom_sleep(1); /* Wait for some entryphy to be gathered */
|
||||||
|
}
|
||||||
|
|
||||||
|
for(i=0; i<5; i++)
|
||||||
|
{
|
||||||
|
tmp = ipcom_random();
|
||||||
|
RAND_seed((char*) &tmp, 4);
|
||||||
|
}
|
||||||
|
|
||||||
|
ipcom_proc_exit();
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
/*
|
||||||
|
*===========================================================================
|
||||||
|
* ipcrypto_dmalloc
|
||||||
|
*===========================================================================
|
||||||
|
* Description:
|
||||||
|
* Parameters:
|
||||||
|
* Returns:
|
||||||
|
*
|
||||||
|
*/
|
||||||
|
#ifdef IPCOM_USE_DMALLOC
|
||||||
|
IP_STATIC void *
|
||||||
|
ipcrypto_dmalloc(Ip_size_t num, const char *file, int line)
|
||||||
|
{
|
||||||
|
return ipcom_dmalloc(num, file, IP_NULL, line);
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
/*
|
||||||
|
*===========================================================================
|
||||||
|
* ipcrypto_drealloc
|
||||||
|
*===========================================================================
|
||||||
|
* Description:
|
||||||
|
* Parameters:
|
||||||
|
* Returns:
|
||||||
|
*
|
||||||
|
*/
|
||||||
|
IP_STATIC void *
|
||||||
|
ipcrypto_drealloc(void *old_ptr, Ip_size_t num, const char *file, int line)
|
||||||
|
{
|
||||||
|
return ipcom_drealloc(old_ptr, num, file, IP_NULL, line);
|
||||||
|
}
|
||||||
|
#endif /* IPCOM_USE_DMALLOC */
|
||||||
|
|
||||||
|
|
||||||
|
/*
|
||||||
|
****************************************************************************
|
||||||
|
* 10 PUBLIC FUNCTIONS
|
||||||
|
****************************************************************************
|
||||||
|
*/
|
||||||
|
|
||||||
|
|
||||||
|
/*
|
||||||
|
*===========================================================================
|
||||||
|
* ipcrypto_create
|
||||||
|
*===========================================================================
|
||||||
|
* Description:
|
||||||
|
* Parameters:
|
||||||
|
* Returns:
|
||||||
|
*
|
||||||
|
*/
|
||||||
|
IP_PUBLIC Ip_err
|
||||||
|
ipcrypto_create(void)
|
||||||
|
{
|
||||||
|
static int init = 0;
|
||||||
|
char uninitialized_buf[32];
|
||||||
|
|
||||||
|
if(init == 0)
|
||||||
|
{
|
||||||
|
int ret;
|
||||||
|
init = 1;
|
||||||
|
|
||||||
|
/* Set memory allocation function callbacks. */
|
||||||
|
#ifdef IPCOM_USE_DMALLOC
|
||||||
|
ret = CRYPTO_set_mem_ex_functions(ipcrypto_dmalloc, ipcrypto_drealloc, ipcom_dfree);
|
||||||
|
#else
|
||||||
|
ret = CRYPTO_set_mem_functions(ipcom_malloc, ipcom_realloc, ipcom_free);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
(void) ret;
|
||||||
|
ip_assert(ret);
|
||||||
|
|
||||||
|
if(ipcrypto_setup_lock_functions() != IPCOM_SUCCESS)
|
||||||
|
return IPCOM_ERR_FAILED;
|
||||||
|
|
||||||
|
OpenSSL_add_all_algorithms();
|
||||||
|
|
||||||
|
/* Init things so we will get meaningful error messages rather than numbers. */
|
||||||
|
ERR_load_crypto_strings();
|
||||||
|
|
||||||
|
#ifndef OPENSSL_NO_ENGINE
|
||||||
|
ENGINE_load_builtin_engines();
|
||||||
|
#endif
|
||||||
|
|
||||||
|
/* Dummy seed to make RAND functions operational */
|
||||||
|
#ifdef IPVALGRIND
|
||||||
|
ipcom_memset(uninitialized_buf, 0, sizeof(uninitialized_buf));
|
||||||
|
#endif
|
||||||
|
RAND_seed((char *) uninitialized_buf, sizeof(uninitialized_buf));
|
||||||
|
|
||||||
|
#ifdef OPENSSL_FIPS
|
||||||
|
{
|
||||||
|
unsigned int i;
|
||||||
|
Ip_bool enable_fips = IP_FALSE;
|
||||||
|
#if defined(IP_DEBUG) || defined(IPTESTENGINE)
|
||||||
|
int len;
|
||||||
|
|
||||||
|
len=FIPS_incore_fingerprint(ipcrypto_fips_signature, sizeof(ipcrypto_fips_signature));
|
||||||
|
if (len!=sizeof(ipcrypto_fips_signature))
|
||||||
|
{
|
||||||
|
IPCOM_LOG0(ERR, "FIPS_incore_fingerprint() failed");
|
||||||
|
return IPCOM_ERR_FAILED;
|
||||||
|
}
|
||||||
|
#endif
|
||||||
|
for (i=0; i<sizeof(ipcrypto_fips_signature); i++)
|
||||||
|
{
|
||||||
|
if (ipcrypto_fips_signature[i] != 0xEE)
|
||||||
|
{
|
||||||
|
enable_fips = IP_TRUE;
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if (enable_fips)
|
||||||
|
{
|
||||||
|
ipcom_memcpy(FIPS_signature, ipcrypto_fips_signature, sizeof(FIPS_signature));
|
||||||
|
FIPS_mode_set(1);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
#endif
|
||||||
|
}
|
||||||
|
|
||||||
|
return IPCOM_SUCCESS;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
/*
|
||||||
|
*===========================================================================
|
||||||
|
* ipcrypto_start
|
||||||
|
*===========================================================================
|
||||||
|
*/
|
||||||
|
IP_PUBLIC Ip_err
|
||||||
|
ipcrypto_start(void)
|
||||||
|
{
|
||||||
|
Ipcom_proc_attr proc_attr;
|
||||||
|
|
||||||
|
ipcom_proc_attr_init(&proc_attr);
|
||||||
|
proc_attr.stacksize = IPCOM_PROC_STACK_SMALL;
|
||||||
|
proc_attr.flags = IPCOM_PROC_FLAG_FP;
|
||||||
|
(void)ipcom_proc_acreate("ipcrypto_rnd_seed", ipcrypto_rnd_seed, &proc_attr, IP_NULL);
|
||||||
|
|
||||||
|
return IPCOM_SUCCESS;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
/*
|
||||||
|
*===========================================================================
|
||||||
|
* ipcrypto_version
|
||||||
|
*===========================================================================
|
||||||
|
* Description:
|
||||||
|
* Parameters:
|
||||||
|
* Returns:
|
||||||
|
*
|
||||||
|
*/
|
||||||
|
IP_PUBLIC const char *
|
||||||
|
ipcrypto_version(void)
|
||||||
|
{
|
||||||
|
#ifdef OPENSSL_FIPS
|
||||||
|
return "@(#) IPCRYPTO FIPS 140-2 $Name: VXWORKS_ITER40_2019102207 $ - INTERPEAK_COPYRIGHT_STRING";
|
||||||
|
#else
|
||||||
|
return "@(#) IPCRYPTO $Name: VXWORKS_ITER40_2019102207 $ - INTERPEAK_COPYRIGHT_STRING";
|
||||||
|
#endif
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
void
|
||||||
|
OPENSSL_init(void)
|
||||||
|
{
|
||||||
|
/* Dummy function to make the linker happy */
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
/*
|
||||||
|
****************************************************************************
|
||||||
|
* END OF FILE
|
||||||
|
****************************************************************************
|
||||||
|
*/
|
||||||
|
|
||||||
@@ -0,0 +1,89 @@
|
|||||||
|
#ifndef IPCRYPTO_START_H
|
||||||
|
#define IPCRYPTO_START_H
|
||||||
|
|
||||||
|
#ifdef __cplusplus
|
||||||
|
extern "C" {
|
||||||
|
#endif
|
||||||
|
|
||||||
|
/*
|
||||||
|
****************************************************************************
|
||||||
|
* 4 DEFINES
|
||||||
|
****************************************************************************
|
||||||
|
*/
|
||||||
|
#define ipcom_free free
|
||||||
|
#define ipcom_calloc calloc
|
||||||
|
#define ipcom_strdup strdup
|
||||||
|
#define ipcom_malloc malloc
|
||||||
|
#define ipcom_memcpy memcpy
|
||||||
|
#define ipcom_memset memset
|
||||||
|
#define ipcom_realloc realloc
|
||||||
|
|
||||||
|
#define IP_NOOP do {} while ((0))
|
||||||
|
|
||||||
|
/* ip_assert() defined in ipcom_debug.c. for now, do nothing */
|
||||||
|
#define ip_assert(xexpr) IP_NOOP
|
||||||
|
|
||||||
|
/*
|
||||||
|
****************************************************************************
|
||||||
|
* 5 TYPES
|
||||||
|
****************************************************************************
|
||||||
|
*/
|
||||||
|
/* Mutex type */
|
||||||
|
typedef void * Ipcom_mutex;
|
||||||
|
|
||||||
|
struct Ipcrypto_data_st
|
||||||
|
{
|
||||||
|
Ipcom_mutex* crypto_locks;
|
||||||
|
};
|
||||||
|
|
||||||
|
typedef struct Ipcrypto_data_st Ipcrypto_data;
|
||||||
|
|
||||||
|
IP_EXTERN Ipcrypto_data ipcrypto;
|
||||||
|
|
||||||
|
/*
|
||||||
|
*===========================================================================
|
||||||
|
* Ip_cpu_set_t
|
||||||
|
*===========================================================================
|
||||||
|
*/
|
||||||
|
|
||||||
|
/* CPU Affinity - must be less than or equal to CPU_SETSIZE in the OS */
|
||||||
|
#define IP_CPU_SETSIZE 32
|
||||||
|
|
||||||
|
typedef struct Ip_cpu_set_t_struct
|
||||||
|
{
|
||||||
|
Ip_u32 set[(IP_CPU_SETSIZE + sizeof(Ip_u32) * 8 - 1) / (sizeof(Ip_u32) * 8)];
|
||||||
|
}
|
||||||
|
Ip_cpu_set_t;
|
||||||
|
|
||||||
|
/*
|
||||||
|
*===========================================================================
|
||||||
|
* Ipcom_proc_attr
|
||||||
|
*===========================================================================
|
||||||
|
*/
|
||||||
|
typedef struct Ipcom_proc_attr_struct
|
||||||
|
{
|
||||||
|
Ip_s32 priority; /* Process priority. See ipcom_pconfig.h */
|
||||||
|
Ip_u32 stacksize; /* Stacksize. See ipcom_pconfig.h */
|
||||||
|
Ip_u32 flags;
|
||||||
|
Ip_cpu_set_t cpuset; /* CPU affinity */
|
||||||
|
}
|
||||||
|
Ipcom_proc_attr;
|
||||||
|
|
||||||
|
/* Inherit attributes from creator. */
|
||||||
|
#define IPCOM_PROC_PRIO_INHERIT (IPCOM_PRIORITY_MAX + 1)
|
||||||
|
#define IPCOM_PROC_STACK_INHERIT 0
|
||||||
|
|
||||||
|
#define IPCOM_PROC_FLAG_FP (1) /* Set if task will use floating point operations */
|
||||||
|
|
||||||
|
|
||||||
|
#ifdef __cplusplus
|
||||||
|
}
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
|
/*
|
||||||
|
****************************************************************************
|
||||||
|
* END OF FILE
|
||||||
|
****************************************************************************
|
||||||
|
*/
|
||||||
Reference in New Issue
Block a user