Improvements for disabled sections in pwdbased.c, asn.c, rsa.c, pkcs12.c and wc_encrypt.c. Adds --enable-pkcs12, HAVE_PKCS12/NO_PKCS12, HAVE_PKCS8 / NO_PKCS8 and HAVE_PBKDF1 / NO_PBKDF1.

2019-07-02 09:35:46 -07:00
parent fd71618f10
commit eba78cd87a
9 changed files with 80 additions and 9 deletions
--- a/configure.ac
+++ b/configure.ac
@ -3658,6 +3658,20 @@ then
 fi


+# PKCS#12
+AC_ARG_ENABLE([pkcs12],
+    [AS_HELP_STRING([--enable-pkcs12],[Enable pkcs12 (default: enabled)])],
+    [ ENABLED_PKCS12=$enableval ],
+    [ ENABLED_PKCS12=yes ]
+    )
+
+if test "x$ENABLED_PKCS12" = "xno"
+then
+    AM_CFLAGS="$AM_CFLAGS -DNO_PKCS12"
+fi
+AM_CONDITIONAL([BUILD_PKCS12], [test "x$ENABLED_PKCS12" = "xyes"])
+
+
 # cavium
 trycaviumdir=""
 AC_ARG_WITH([cavium],
@ -4988,6 +5002,7 @@ echo "   * Fast RSA:                   $ENABLED_FAST_RSA"
 echo "   * Single Precision:           $ENABLED_SP"
 echo "   * Async Crypto:               $ENABLED_ASYNCCRYPT"
 echo "   * PKCS#11:                    $ENABLED_PKCS11"
+echo "   * PKCS#12:                    $ENABLED_PKCS12"
 echo "   * Cavium:                     $ENABLED_CAVIUM"
 echo "   * ARM ASM:                    $ENABLED_ARMASM"
 echo "   * AES Key Wrap:               $ENABLED_AESKEYWRAP"
--- a/wolfcrypt/src/asn.c
+++ b/wolfcrypt/src/asn.c
@ -2305,6 +2305,8 @@ int wc_RsaPrivateKeyDecode(const byte* input, word32* inOutIdx, RsaKey* key,
 #endif /* HAVE_USER_RSA */
 #endif /* NO_RSA */

+#ifdef HAVE_PKCS8
+
 /* Remove PKCS8 header, place inOutIdx at beginning of traditional,
 * return traditional length on success, negative on error */
 int ToTraditionalInline_ex(const byte* input, word32* inOutIdx, word32 sz,
@ -2502,7 +2504,9 @@ int wc_CreatePKCS8Key(byte* out, word32* outSz, byte* key, word32 keySz,
        return tmpSz + sz;
 }

+#endif /* HAVE_PKCS8 */

+#ifdef HAVE_PKCS12
 /* check that the private key is a pair for the public key in certificate
 * return 1 (true) on match
 * return 0 or negative value on failure/error
@ -2705,8 +2709,11 @@ int wc_CheckPrivateKey(byte* key, word32 keySz, DecodedCert* der)
    return ret;
 }

+#endif /* HAVE_PKCS12 */
+
 #ifndef NO_PWDBASED

+#ifdef HAVE_PKCS8
 /* Check To see if PKCS version algo is supported, set id if it is return 0
   < 0 on error */
 static int CheckAlgo(int first, int second, int* id, int* version, int* blockSz)
@ -3482,6 +3489,9 @@ exit_tte:
    return ret;
 }

+#endif /* HAVE_PKCS8 */
+
+#ifdef HAVE_PKCS12

 /* encrypt PKCS 12 content
 *
@ -3837,6 +3847,7 @@ exit_dc:

    return ret;
 }
+#endif /* HAVE_PKCS12 */
 #endif /* NO_PWDBASED */

 #ifndef NO_RSA
@ -4196,7 +4207,6 @@ int wc_DsaKeyToDer(DsaKey* key, byte* output, word32 inLen)

 #endif /* NO_DSA */

-
 void InitDecodedCert(DecodedCert* cert,
                     const byte* source, word32 inSz, void* heap)
 {
@ -4218,7 +4228,9 @@ void InitDecodedCert(DecodedCert* cert,
        cert->subjectOUEnc    = CTC_UTF8;
    #endif /* WOLFSSL_CERT_GEN */

+    #ifndef NO_CERTS
        InitSignatureCtx(&cert->sigCtx, heap, INVALID_DEVID);
+    #endif
    }
 }

@ -4282,7 +4294,9 @@ void FreeDecodedCert(DecodedCert* cert)
    if (cert->subjectName.fullName != NULL)
        XFREE(cert->subjectName.fullName, cert->heap, DYNAMIC_TYPE_X509);
 #endif /* OPENSSL_EXTRA */
+#ifndef NO_CERTS
    FreeSignatureCtx(&cert->sigCtx);
+#endif
 }

 static int GetCertHeader(DecodedCert* cert)
@ -5729,7 +5743,6 @@ int wc_GetPubX509(DecodedCert* cert, int verify, int* badDate)
    return ret;
 }

-
 int DecodeToKey(DecodedCert* cert, int verify)
 {
    int badDate = 0;
@ -5964,6 +5977,8 @@ word32 wc_EncodeSignature(byte* out, const byte* digest, word32 digSz,
 }


+#ifndef NO_CERTS
+
 int wc_GetCTC_HashOID(int type)
 {
    int ret;
@ -8460,6 +8475,8 @@ WOLFSSL_LOCAL int SetSerialNumber(const byte* sn, word32 snSz, byte* output,
    return i;
 }

+#endif /* !NO_CERTS */
+
 WOLFSSL_LOCAL int GetSerialNumber(const byte* input, word32* inOutIdx,
    byte* serial, int* serialSz, word32 maxIdx)
 {
@ -8494,6 +8511,7 @@ WOLFSSL_LOCAL int GetSerialNumber(const byte* input, word32* inOutIdx,
    return result;
 }

+#ifndef NO_CERTS

 int AllocDer(DerBuffer** pDer, word32 length, int type, void* heap)
 {
@ -13391,6 +13409,7 @@ int wc_SetDatesBuffer(Cert* cert, const byte* der, int derSz)

 #endif /* WOLFSSL_CERT_GEN */

+#endif /* !NO_CERTS */

 #ifdef HAVE_ECC

--- a/wolfcrypt/src/pkcs12.c
+++ b/wolfcrypt/src/pkcs12.c
@ -26,7 +26,7 @@

 #include <wolfssl/wolfcrypt/settings.h>

-#if !defined(NO_ASN) && !defined(NO_PWDBASED)
+#if !defined(NO_ASN) && !defined(NO_PWDBASED) && defined(HAVE_PKCS12)

 #include <wolfssl/wolfcrypt/asn.h>
 #include <wolfssl/wolfcrypt/asn_public.h>
@ -2076,4 +2076,4 @@ void* wc_PKCS12_GetHeap(WC_PKCS12* pkcs12)

 #undef ERROR_OUT

-#endif /* !NO_ASN && !NO_PWDBASED */
+#endif /* !NO_ASN && !NO_PWDBASED && HAVE_PKCS12 */
--- a/wolfcrypt/src/pwdbased.c
+++ b/wolfcrypt/src/pwdbased.c
@ -42,6 +42,8 @@
 #endif


+#ifdef HAVE_PBKDF1
+
 /* PKCS#5 v1.5 with non standard extension to optionally derive the extra data (IV) */
 int wc_PBKDF1_ex(byte* key, int keyLen, byte* iv, int ivLen,
    const byte* passwd, int passwdLen, const byte* salt, int saltLen,
@ -165,6 +167,9 @@ int wc_PBKDF1(byte* output, const byte* passwd, int pLen, const byte* salt,
        passwd, pLen, salt, sLen, iterations, hashType, NULL);
 }

+#endif /* HAVE_PKCS5 */
+
+#ifdef HAVE_PBKDF2

 int wc_PBKDF2(byte* output, const byte* passwd, int pLen, const byte* salt,
           int sLen, int iterations, int kLen, int hashType)
@ -265,6 +270,10 @@ int wc_PBKDF2(byte* output, const byte* passwd, int pLen, const byte* salt,
    return ret;
 }

+#endif /* HAVE_PBKDF2 */
+
+#ifdef HAVE_PKCS12
+
 /* helper for PKCS12_PBKDF(), does hash operation */
 static int DoPKCS12Hash(int hashType, byte* buffer, word32 totalLen,
                 byte* Ai, word32 u, int iterations)
@ -502,6 +511,8 @@ int wc_PKCS12_PBKDF_ex(byte* output, const byte* passwd, int passLen,
    return ret;
 }

+#endif /* HAVE_PKCS12 */
+
 #ifdef HAVE_SCRYPT
 /* Rotate the 32-bit value a by b bits to the left.
 *
@ -737,9 +748,6 @@ end:

    return ret;
 }
-#endif
-
-#undef WC_MAX_DIGEST_SIZE
+#endif /* HAVE_SCRYPT */

 #endif /* NO_PWDBASED */
-
--- a/wolfcrypt/src/rsa.c
+++ b/wolfcrypt/src/rsa.c
@ -570,6 +570,7 @@ int wc_FreeRsaKey(RsaKey* key)
 }

 #ifndef WOLFSSL_RSA_PUBLIC_ONLY
+#if defined(WOLFSSL_KEY_GEN) && !defined(WOLFSSL_NO_RSA_KEY_CHECK)
 /* Check the pair-wise consistency of the RSA key.
 * From NIST SP 800-56B, section 6.4.1.1.
 * Verify that k = (k^e)^d, for some k: 1 < k < n-1. */
@ -662,6 +663,7 @@ int wc_CheckRsaKey(RsaKey* key)
    return ret;
 }
 #endif
+#endif


 #if !defined(WC_NO_RSA_OAEP) || defined(WC_RSA_PSS)
@ -3765,9 +3767,11 @@ int wc_MakeRsaKey(RsaKey* key, int size, long e, WC_RNG* rng)
    mp_clear(&p);
    mp_clear(&q);

+#if defined(WOLFSSL_KEY_GEN) && !defined(WOLFSSL_NO_RSA_KEY_CHECK)
    /* Perform the pair-wise consistency test on the new key. */
    if (err == 0)
        err = wc_CheckRsaKey(key);
+#endif

    if (err != 0) {
        wc_FreeRsaKey(key);
--- a/wolfcrypt/src/wc_encrypt.c
+++ b/wolfcrypt/src/wc_encrypt.c
@ -365,6 +365,7 @@ int wc_BufferKeyEncrypt(EncryptedInfo* info, byte* der, word32 derSz,

 #ifndef NO_PWDBASED

+#if defined(HAVE_PKCS8) || defined(HAVE_PKCS12)
 /* Decrypt/Encrypt input in place from parameters based on id
 *
 * returns a negative value on fail case
@ -617,4 +618,5 @@ int wc_CryptKey(const char* password, int passwordSz, byte* salt,
    return ret;
 }

+#endif /* HAVE_PKCS8 || HAVE_PKCS12 */
 #endif /* !NO_PWDBASED */
--- a/wolfssl/wolfcrypt/asn.h
+++ b/wolfssl/wolfcrypt/asn.h
@ -826,7 +826,9 @@ struct DecodedCert {
 #endif /* defined(WOLFSSL_CERT_GEN) || defined(WOLFSSL_CERT_EXT) */

    Signer* ca;
+#ifndef NO_CERTS
    SignatureCtx sigCtx;
+#endif

    /* Option Bits */
    byte subjectCNStored : 1;      /* have we saved a copy we own */
--- a/wolfssl/wolfcrypt/rsa.h
+++ b/wolfssl/wolfcrypt/rsa.h
@ -320,7 +320,7 @@ WOLFSSL_API int wc_RsaDirect(byte* in, word32 inLen, byte* out, word32* outSz,
                   RsaKey* key, int type, WC_RNG* rng);
 #endif

-#endif /* HAVE_FIPS*/
+#endif /* HAVE_FIPS */

 WOLFSSL_API int  wc_RsaFlattenPublicKey(RsaKey*, byte*, word32*, byte*,
                                                                       word32*);
--- a/wolfssl/wolfcrypt/settings.h
+++ b/wolfssl/wolfcrypt/settings.h
@ -1837,6 +1837,27 @@ extern void uITRON4_free(void *p) ;
    #endif
 #endif

+#ifndef NO_PKCS12
+    #undef  HAVE_PKCS12
+    #define HAVE_PKCS12
+#endif
+
+#ifndef NO_PKCS8
+    #undef  HAVE_PKCS8
+    #define HAVE_PKCS8
+#endif
+
+#if !defined(NO_PBKDF1) || defined(WOLFSSL_ENCRYPTED_KEYS) || defined(HAVE_PKCS8) || defined(HAVE_PKCS12)
+    #undef  HAVE_PBKDF1
+    #define HAVE_PBKDF1
+#endif
+
+#if !defined(NO_PBKDF2) || defined(HAVE_PKCS7) || defined(HAVE_SCRYPT)
+    #undef  HAVE_PBKDF2
+    #define HAVE_PBKDF2
+#endif
+
+
 #if !defined(WOLFCRYPT_ONLY) && !defined(NO_OLD_TLS) && \
        (defined(NO_SHA) || defined(NO_MD5))
    #error old TLS requires MD5 and SHA