mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-07-08 07:10:48 +02:00
linuxkm/linuxkm_wc_port.h:
* set up WC_LINUXKM_HAVE_SELFTEST and WC_LINUXKM_HAVE_SELFTEST_FULL early. * replace the forced-downgrade from FIPS 186-5 to 186-4 for SHA-1 support, with a #error if configuration is incompatible. linuxkm/linuxkm_wc_port.h, linuxkm/lkcapi_glue.c, linuxkm/module_exports.c.template, linuxkm/module_hooks.c, wolfcrypt/src/random.c: consolidate into the warning-masked span of linuxkm_wc_port.h, the #includes for kernel headers linux/fips.h, linux/vmalloc.h, and linux/random.h.
This commit is contained in:
Daniel Pouzzner
+39
-32
@@ -35,28 +35,43 @@
|
||||
#error Unsupported kernel.
|
||||
#endif
|
||||
|
||||
#if defined(HAVE_FIPS) && defined(LINUXKM_LKCAPI_REGISTER_AESXTS) && defined(CONFIG_CRYPTO_MANAGER_EXTRA_TESTS)
|
||||
#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 16, 0)
|
||||
#if defined(CONFIG_CRYPTO_MANAGER) && !defined(CONFIG_CRYPTO_MANAGER_DISABLE_TESTS)
|
||||
#define WC_LINUXKM_HAVE_SELFTEST
|
||||
#endif
|
||||
#if defined(WC_LINUXKM_HAVE_SELFTEST) && defined(CONFIG_CRYPTO_MANAGER_EXTRA_TESTS)
|
||||
#define WC_LINUXKM_HAVE_SELFTEST_FULL
|
||||
#endif
|
||||
#else
|
||||
/* see Linux 698de822780f */
|
||||
#if defined(CONFIG_CRYPTO_MANAGER) && defined(CONFIG_CRYPTO_SELFTESTS)
|
||||
#define WC_LINUXKM_HAVE_SELFTEST
|
||||
#endif
|
||||
/* see Linux ac90aad0e9 */
|
||||
#if defined(WC_LINUXKM_HAVE_SELFTEST) && defined(CONFIG_CRYPTO_SELFTESTS_FULL)
|
||||
#define WC_LINUXKM_HAVE_SELFTEST_FULL
|
||||
#endif
|
||||
#endif
|
||||
|
||||
#if defined(HAVE_FIPS) && defined(LINUXKM_LKCAPI_REGISTER_AESXTS) && defined(WC_LINUXKM_HAVE_SELFTEST_FULL)
|
||||
/* CONFIG_CRYPTO_MANAGER_EXTRA_TESTS expects AES-XTS-384 to work, even when CONFIG_CRYPTO_FIPS, but FIPS 140-3 only allows AES-XTS-256 and AES-XTS-512. */
|
||||
#error CONFIG_CRYPTO_MANAGER_EXTRA_TESTS is incompatible with FIPS wolfCrypt AES-XTS -- please reconfigure the target kernel to disable CONFIG_CRYPTO_MANAGER_EXTRA_TESTS.
|
||||
#error CONFIG_CRYPTO_MANAGER_EXTRA_TESTS is incompatible with FIPS wolfCrypt AES-XTS -- please reconfigure the target kernel to disable CONFIG_CRYPTO_MANAGER_EXTRA_TESTS/CONFIG_CRYPTO_SELFTESTS_FULL.
|
||||
#endif
|
||||
|
||||
/* The first vector set in /usr/src/linux/crypto/testmgr.h
|
||||
* ecdsa_nist_p192_tv_template[], ecdsa_nist_p256_tv_template[], and
|
||||
* ecdsa_nist_p384_tv_template[] use SHA-1 (even if CONFIG_CRYPTO_SHA1 is
|
||||
* disabled), and kernel module signatures frequently use SHA-1 until quite
|
||||
* recently (dependent on CONFIG_CRYPTO_SHA1). If either is enabled, force
|
||||
* downgrade to 186-4.
|
||||
* recently.
|
||||
*/
|
||||
#if defined(WC_FIPS_186_5_PLUS) && \
|
||||
(defined(CONFIG_CRYPTO_SHA1) || (defined(CONFIG_CRYPTO_MANAGER) && !defined(CONFIG_CRYPTO_MANAGER_DISABLE_TESTS))) && \
|
||||
(defined(LINUXKM_LKCAPI_REGISTER_ALL) || defined(LINUXKM_LKCAPI_REGISTER_ALL_KCONFIG) || defined(CONFIG_CRYPTO_ECDSA))
|
||||
#undef WC_FIPS_186_5_PLUS
|
||||
#ifdef WC_FIPS_186_5
|
||||
#undef WC_FIPS_186_5
|
||||
#else
|
||||
#error Unknown and incompatible FIPS 186 is enabled.
|
||||
#endif
|
||||
#define WC_FIPS_186_4
|
||||
#if (defined(WC_LINUXKM_HAVE_SELFTEST) || defined(CONFIG_MODULE_SIG_SHA1)) && \
|
||||
(((defined(WC_MIN_DIGEST_SIZE_FOR_VERIFY) && (WC_MIN_DIGEST_SIZE_FOR_VERIFY > 20)) || \
|
||||
(defined(NO_SHA) && !defined(WC_MIN_DIGEST_SIZE_FOR_VERIFY)))) && \
|
||||
defined(HAVE_ECC) && \
|
||||
(defined(LINUXKM_LKCAPI_REGISTER_ALL) || \
|
||||
defined(LINUXKM_LKCAPI_REGISTER_ECDSA) || \
|
||||
(defined(LINUXKM_LKCAPI_REGISTER_ALL_KCONFIG) && defined(CONFIG_CRYPTO_ECDSA)))
|
||||
#error Target kernel requires SHA-1 signature verification support.
|
||||
#endif
|
||||
|
||||
#ifdef HAVE_CONFIG_H
|
||||
@@ -427,24 +442,7 @@
|
||||
|
||||
#include <linux/kernel.h>
|
||||
#include <linux/ctype.h>
|
||||
|
||||
#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 16, 0)
|
||||
#if defined(CONFIG_CRYPTO_MANAGER) && !defined(CONFIG_CRYPTO_MANAGER_DISABLE_TESTS)
|
||||
#define WC_LINUXKM_HAVE_SELFTEST
|
||||
#endif
|
||||
#if defined(WC_LINUXKM_HAVE_SELFTEST) && defined(CONFIG_CRYPTO_MANAGER_EXTRA_TESTS)
|
||||
#define WC_LINUXKM_HAVE_SELFTEST_FULL
|
||||
#endif
|
||||
#else
|
||||
/* see Linux 698de822780f */
|
||||
#if defined(CONFIG_CRYPTO_MANAGER) && defined(CONFIG_CRYPTO_SELFTESTS)
|
||||
#define WC_LINUXKM_HAVE_SELFTEST
|
||||
#endif
|
||||
/* see Linux ac90aad0e9 */
|
||||
#if defined(WC_LINUXKM_HAVE_SELFTEST) && defined(CONFIG_CRYPTO_SELFTESTS_FULL)
|
||||
#define WC_LINUXKM_HAVE_SELFTEST_FULL
|
||||
#endif
|
||||
#endif
|
||||
#include <linux/fips.h>
|
||||
|
||||
/* Kernel non-FIPS self-test ("testmgr") has a KAT with all-zeros keys. */
|
||||
#if defined(WC_LINUXKM_HAVE_SELFTEST) && !defined(HAVE_FIPS)
|
||||
@@ -655,6 +653,12 @@
|
||||
#include <linux/uaccess.h>
|
||||
#endif
|
||||
#include <linux/slab.h>
|
||||
#ifndef WC_CONTAINERIZE_THIS
|
||||
/* for struct vm_struct and related -- used by
|
||||
* wc_linuxkm_malloc_usable_size().
|
||||
*/
|
||||
#include <linux/vmalloc.h>
|
||||
#endif
|
||||
#include <linux/sched.h>
|
||||
#if __has_include(<linux/sched/task_stack.h>)
|
||||
/* for task_stack_page() */
|
||||
@@ -823,6 +827,9 @@
|
||||
#error WOLFSSL_USE_SAVE_VECTOR_REGISTERS is set for an unimplemented architecture.
|
||||
#endif /* WOLFSSL_USE_SAVE_VECTOR_REGISTERS */
|
||||
|
||||
/* This pop must appear here, no later, so that conditional suppressions
|
||||
* below continue after inclusion.
|
||||
*/
|
||||
_Pragma("GCC diagnostic pop");
|
||||
|
||||
#define PTR_ERR(x) ((int)PTR_ERR(x))
|
||||
|
||||
+40
-12
@@ -40,7 +40,6 @@
|
||||
#if defined(CONFIG_CRYPTO_FIPS) != defined(HAVE_FIPS)
|
||||
#error CONFIG_CRYPTO_MANAGER requires that CONFIG_CRYPTO_FIPS match HAVE_FIPS.
|
||||
#endif
|
||||
#include <linux/fips.h>
|
||||
#endif
|
||||
|
||||
/* need misc.c for ForceZero(). */
|
||||
@@ -553,7 +552,24 @@ static int linuxkm_lkcapi_register(void)
|
||||
#endif
|
||||
|
||||
#ifdef LINUXKM_LKCAPI_REGISTER_ECDSA
|
||||
#if (LINUX_VERSION_CODE < KERNEL_VERSION(6, 3, 0)) && \
|
||||
#if defined(LINUXKM_ECDSA_SIG_ALG)
|
||||
/* linux 6.13+: the ecdsa-nist-pN algs are struct sig_alg. */
|
||||
#if defined(LINUXKM_ECC192)
|
||||
REGISTER_ALG(ecdsa_nist_p192, sig,
|
||||
linuxkm_test_ecdsa_nist_p192);
|
||||
#endif /* LINUXKM_ECC192 */
|
||||
|
||||
REGISTER_ALG(ecdsa_nist_p256, sig,
|
||||
linuxkm_test_ecdsa_nist_p256);
|
||||
|
||||
REGISTER_ALG(ecdsa_nist_p384, sig,
|
||||
linuxkm_test_ecdsa_nist_p384);
|
||||
|
||||
#if defined(HAVE_ECC521)
|
||||
REGISTER_ALG(ecdsa_nist_p521, sig,
|
||||
linuxkm_test_ecdsa_nist_p521);
|
||||
#endif /* HAVE_ECC521 */
|
||||
#elif (LINUX_VERSION_CODE < KERNEL_VERSION(6, 3, 0)) && \
|
||||
defined(HAVE_FIPS) && defined(CONFIG_CRYPTO_FIPS) && \
|
||||
defined(WC_LINUXKM_HAVE_SELFTEST)
|
||||
/*
|
||||
@@ -575,7 +591,7 @@ static int linuxkm_lkcapi_register(void)
|
||||
REGISTER_ALG_OPTIONAL(ecdsa_nist_p521, akcipher,
|
||||
linuxkm_test_ecdsa_nist_p521);
|
||||
#endif /* HAVE_ECC521 */
|
||||
#else
|
||||
#else /* kernel 6.3-6.12 */
|
||||
#if defined(LINUXKM_ECC192)
|
||||
REGISTER_ALG(ecdsa_nist_p192, akcipher,
|
||||
linuxkm_test_ecdsa_nist_p192);
|
||||
@@ -591,7 +607,7 @@ static int linuxkm_lkcapi_register(void)
|
||||
REGISTER_ALG(ecdsa_nist_p521, akcipher,
|
||||
linuxkm_test_ecdsa_nist_p521);
|
||||
#endif /* HAVE_ECC521 */
|
||||
#endif /* if linux < 6.3 && HAVE_FIPS && etc.. */
|
||||
#endif /* kernel 6.3-6.12 */
|
||||
|
||||
#if (LINUX_VERSION_CODE < KERNEL_VERSION(6, 3, 0)) && \
|
||||
defined(HAVE_FIPS) && defined(CONFIG_CRYPTO_FIPS) && \
|
||||
@@ -917,14 +933,26 @@ static int linuxkm_lkcapi_unregister(void)
|
||||
#endif
|
||||
|
||||
#ifdef LINUXKM_LKCAPI_REGISTER_ECDSA
|
||||
#if defined(LINUXKM_ECC192)
|
||||
UNREGISTER_ALG(ecdsa_nist_p192, akcipher);
|
||||
#endif /* LINUXKM_ECC192 */
|
||||
UNREGISTER_ALG(ecdsa_nist_p256, akcipher);
|
||||
UNREGISTER_ALG(ecdsa_nist_p384, akcipher);
|
||||
#if defined(HAVE_ECC521)
|
||||
UNREGISTER_ALG(ecdsa_nist_p521, akcipher);
|
||||
#endif /* HAVE_ECC521 */
|
||||
#if defined(LINUXKM_ECDSA_SIG_ALG)
|
||||
/* linux 6.13+: the ecdsa-nist-pN algs are struct sig_alg. */
|
||||
#if defined(LINUXKM_ECC192)
|
||||
UNREGISTER_ALG(ecdsa_nist_p192, sig);
|
||||
#endif /* LINUXKM_ECC192 */
|
||||
UNREGISTER_ALG(ecdsa_nist_p256, sig);
|
||||
UNREGISTER_ALG(ecdsa_nist_p384, sig);
|
||||
#if defined(HAVE_ECC521)
|
||||
UNREGISTER_ALG(ecdsa_nist_p521, sig);
|
||||
#endif /* HAVE_ECC521 */
|
||||
#else /* !LINUXKM_ECDSA_SIG_ALG */
|
||||
#if defined(LINUXKM_ECC192)
|
||||
UNREGISTER_ALG(ecdsa_nist_p192, akcipher);
|
||||
#endif /* LINUXKM_ECC192 */
|
||||
UNREGISTER_ALG(ecdsa_nist_p256, akcipher);
|
||||
UNREGISTER_ALG(ecdsa_nist_p384, akcipher);
|
||||
#if defined(HAVE_ECC521)
|
||||
UNREGISTER_ALG(ecdsa_nist_p521, akcipher);
|
||||
#endif /* HAVE_ECC521 */
|
||||
#endif /* !LINUXKM_ECDSA_SIG_ALG */
|
||||
#endif /* LINUXKM_LKCAPI_REGISTER_ECDSA */
|
||||
|
||||
#ifdef LINUXKM_LKCAPI_REGISTER_ECDH
|
||||
|
||||
@@ -32,7 +32,6 @@
|
||||
#endif
|
||||
#ifndef NO_CRYPT_TEST
|
||||
#include <wolfcrypt/test/test.h>
|
||||
#include <linux/delay.h>
|
||||
#endif
|
||||
|
||||
#ifndef EXPORT_SYMBOL_NS
|
||||
|
||||
@@ -1316,10 +1316,6 @@ void *wc_linuxkm_realloc(void *ptr, size_t newsize)
|
||||
return kvrealloc(ptr, WC_LINUXKM_ROUND_UP_P_OF_2(newsize), (wc_linuxkm_can_block() ? GFP_KERNEL : GFP_ATOMIC));
|
||||
}
|
||||
|
||||
#ifdef CONFIG_HAVE_KPROBES
|
||||
#include <linux/vmalloc.h>
|
||||
#endif
|
||||
|
||||
size_t wc_linuxkm_malloc_usable_size(void *ptr)
|
||||
{
|
||||
if ((ptr == NULL) || is_vmalloc_addr(ptr)) {
|
||||
|
||||
@@ -4915,10 +4915,6 @@ int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz)
|
||||
|
||||
#elif defined(WOLFSSL_LINUXKM)
|
||||
|
||||
#ifndef LINUXKM_LKCAPI_REGISTER_HASH_DRBG_DEFAULT
|
||||
#include <linux/random.h>
|
||||
#endif
|
||||
|
||||
int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz)
|
||||
{
|
||||
(void)os;
|
||||
|
||||
Reference in New Issue
Block a user