mirrors
/
wolfssl
mirror of https://github.com/wolfSSL/wolfssl
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4780 from dgarske/ipsec_racoon

This commit is contained in:
Hayden Roche 2022-01-31 15:10:58 -08:00 committed by GitHub
parent df85ea7e87 c69010adef
commit 24a2ed7e9e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
11 changed files with 192 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
doc/dox_comments/header_files/evp.h
View File

@ -371,6 +371,7 @@ WOLFSSL_API int wolfSSL_EVP_CIPHER_block_size(const WOLFSSL_EVP_CIPHER *cipher);
\endcode
\sa wolfSSL_EVP_CIPHER_flags
\sa wolfSSL_EVP_CIPHER_CTX_flags
*/
WOLFSSL_API void wolfSSL_EVP_CIPHER_CTX_set_flags(WOLFSSL_EVP_CIPHER_CTX *ctx, int flags);
@ -393,6 +394,7 @@ WOLFSSL_API void wolfSSL_EVP_CIPHER_CTX_set_flags(WOLFSSL_EVP_CIPHER_CTX *ctx, i
\endcode
\sa wolfSSL_EVP_CIPHER_flags
\sa wolfSSL_EVP_CIPHER_CTX_flags
*/
WOLFSSL_API void wolfSSL_EVP_CIPHER_CTX_clear_flags(WOLFSSL_EVP_CIPHER_CTX *ctx, int flags);
@ -414,6 +416,29 @@ WOLFSSL_API void wolfSSL_EVP_CIPHER_CTX_clear_flags(WOLFSSL_EVP_CIPHER_CTX *ctx,
wolfSSL_EVP_CIPHER_CTX_set_padding(ctx, 1);
\endcode
\sa wolfSSL_EVP_CIPHER_flags
\sa wolfSSL_EVP_CIPHER_CTX_new
*/
WOLFSSL_API int wolfSSL_EVP_CIPHER_CTX_set_padding(WOLFSSL_EVP_CIPHER_CTX *c, int pad);
/*!
\ingroup openSSL
\brief Getter function for WOLFSSL_EVP_CIPHER_CTX structure. Deprecated v1.1.0
\return unsigned long of flags/mode.
\param ctx structure to get flag.
_Example_
\code
WOLFSSL_EVP_CIPHER_CTX* ctx;
unsigned long flags;
ctx = wolfSSL_EVP_CIPHER_CTX_new()
flags = wolfSSL_EVP_CIPHER_CTX_flags(ctx);
\endcode
\sa wolfSSL_EVP_CIPHER_CTX_new
\sa wolfSSL_EVP_CIPHER_flags
*/
WOLFSSL_API unsigned long wolfSSL_EVP_CIPHER_CTX_flags(const WOLFSSL_EVP_CIPHER_CTX *ctx);

6
src/internal.c
View File

@ -3915,6 +3915,12 @@ void FreeX509Name(WOLFSSL_X509_NAME* name)
}
}
#endif /* OPENSSL_EXTRA || OPENSSL_EXTRA_X509_SMALL */
#ifdef OPENSSL_ALL
if (name->entries) {
wolfSSL_sk_X509_NAME_ENTRY_free(name->entries);
name->entries = NULL;
}
#endif
}
}

111
src/ssl.c
View File

@ -21771,6 +21771,7 @@ int wolfSSL_sk_push(WOLFSSL_STACK* sk, const void *data)
case STACK_TYPE_X509_EXT:
case STACK_TYPE_NULL:
case STACK_TYPE_X509_NAME:
case STACK_TYPE_X509_NAME_ENTRY:
case STACK_TYPE_CONF_VALUE:
case STACK_TYPE_X509_INFO:
case STACK_TYPE_BY_DIR_entry:
@ -21831,6 +21832,7 @@ int wolfSSL_sk_push(WOLFSSL_STACK* sk, const void *data)
case STACK_TYPE_X509_EXT:
case STACK_TYPE_NULL:
case STACK_TYPE_X509_NAME:
case STACK_TYPE_X509_NAME_ENTRY:
case STACK_TYPE_CONF_VALUE:
case STACK_TYPE_X509_INFO:
case STACK_TYPE_BY_DIR_entry:
@ -22504,6 +22506,7 @@ void *wolfSSL_lh_retrieve(WOLFSSL_STACK *sk, void *data)
case STACK_TYPE_X509_EXT:
case STACK_TYPE_NULL:
case STACK_TYPE_X509_NAME:
case STACK_TYPE_X509_NAME_ENTRY:
case STACK_TYPE_CONF_VALUE:
case STACK_TYPE_X509_INFO:
case STACK_TYPE_BY_DIR_entry:
@ -22529,6 +22532,7 @@ void *wolfSSL_lh_retrieve(WOLFSSL_STACK *sk, void *data)
case STACK_TYPE_X509_EXT:
case STACK_TYPE_NULL:
case STACK_TYPE_X509_NAME:
case STACK_TYPE_X509_NAME_ENTRY:
case STACK_TYPE_CONF_VALUE:
case STACK_TYPE_X509_INFO:
case STACK_TYPE_BY_DIR_entry:
@ -31480,6 +31484,8 @@ void* wolfSSL_sk_value(const WOLFSSL_STACK* sk, int i)
return (void*)sk->data.generic;
case STACK_TYPE_X509_NAME:
return (void*)sk->data.name;
case STACK_TYPE_X509_NAME_ENTRY:
return (void*)sk->data.name_entry;
case STACK_TYPE_CONF_VALUE:
return (void*)sk->data.conf;
case STACK_TYPE_X509_INFO:
@ -31576,6 +31582,7 @@ WOLFSSL_STACK* wolfSSL_sk_dup(WOLFSSL_STACK* sk)
case STACK_TYPE_X509_EXT:
case STACK_TYPE_NULL:
case STACK_TYPE_X509_NAME:
case STACK_TYPE_X509_NAME_ENTRY:
case STACK_TYPE_CONF_VALUE:
case STACK_TYPE_X509_INFO:
case STACK_TYPE_BY_DIR_entry:
@ -31692,6 +31699,12 @@ void wolfSSL_sk_pop_free(WOLF_STACK_OF(WOLFSSL_ASN1_OBJECT)* sk,
func = (wolfSSL_sk_freefunc)wolfSSL_X509_NAME_free;
#endif
break;
case STACK_TYPE_X509_NAME_ENTRY:
#if (defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)) \
&& !defined(WOLFCRYPT_ONLY)
func = (wolfSSL_sk_freefunc)wolfSSL_X509_NAME_ENTRY_free;
#endif
break;
case STACK_TYPE_X509_EXT:
#ifdef OPENSSL_ALL
func = (wolfSSL_sk_freefunc)wolfSSL_X509_EXTENSION_free;
@ -34013,7 +34026,8 @@ int wolfSSL_DH_compute_key(unsigned char* key, const WOLFSSL_BIGNUM* otherPub,
}
#if defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x10100000L
#if defined(OPENSSL_ALL) || \
defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x10100000L
int wolfSSL_DH_set_length(WOLFSSL_DH *dh, long len)
{
WOLFSSL_ENTER("wolfSSL_DH_set_length");
@ -34074,7 +34088,7 @@ int wolfSSL_DH_set0_pqg(WOLFSSL_DH *dh, WOLFSSL_BIGNUM *p,
return WOLFSSL_SUCCESS;
}
#endif /* v1.1.0 or later */
#endif /* OPENSSL_ALL || (v1.1.0 or later) */
#endif /* !HAVE_FIPS || (HAVE_FIPS && !WOLFSSL_DH_EXTRA) ||
* HAVE_FIPS_VERSION > 2 */
@ -36178,6 +36192,9 @@ int wolfSSL_HMAC_Init(WOLFSSL_HMAC_CTX* ctx, const void* key, int keylen,
hmac_error = wc_HmacSetKey(&ctx->hmac, ctx->type, (const byte*)key,
(word32)keylen);
if (hmac_error < 0){
/* in FIPS mode a key < 14 characters will fail here */
WOLFSSL_MSG("hmac set key error");
WOLFSSL_ERROR(hmac_error);
wc_HmacFree(&ctx->hmac);
return WOLFSSL_FAILURE;
}
@ -36202,7 +36219,9 @@ int wolfSSL_HMAC_Init(WOLFSSL_HMAC_CTX* ctx, const void* key, int keylen,
WC_HMAC_BLOCK_SIZE);
if ((hmac_error = _HMAC_Init(&ctx->hmac, ctx->hmac.macType, heap))
!=0) {
return hmac_error;
WOLFSSL_MSG("hmac init error");
WOLFSSL_ERROR(hmac_error);
return WOLFSSL_FAILURE;
}
}
}
@ -45463,7 +45482,7 @@ err:
WOLFSSL_X509_NAME_ENTRY* entry, int idx, int set)
{
WOLFSSL_X509_NAME_ENTRY* current = NULL;
int i;
int ret, i;
#ifdef WOLFSSL_DEBUG_OPENSSL
WOLFSSL_ENTER("wolfSSL_X509_NAME_add_entry()");
@ -45498,16 +45517,33 @@ err:
}
}
current = &(name->entry[i]);
current = &name->entry[i];
if (current->set == 0)
name->entrySz++;
if (wolfSSL_X509_NAME_ENTRY_create_by_NID(&current,
entry->nid,
wolfSSL_ASN1_STRING_type(entry->value),
wolfSSL_ASN1_STRING_data(entry->value),
wolfSSL_ASN1_STRING_length(entry->value))
== NULL) {
WOLFSSL_MSG("Issue adding the name entry");
entry->nid,
wolfSSL_ASN1_STRING_type(entry->value),
wolfSSL_ASN1_STRING_data(entry->value),
wolfSSL_ASN1_STRING_length(entry->value)) != NULL)
{
ret = WOLFSSL_SUCCESS;
#ifdef OPENSSL_ALL
if (name->entries == NULL) {
name->entries = wolfSSL_sk_X509_NAME_new(NULL);
}
if (wolfSSL_sk_X509_NAME_ENTRY_push(name->entries, current
) != WOLFSSL_SUCCESS) {
ret = WOLFSSL_FAILURE;
}
#endif
}
else {
ret = WOLFSSL_FAILURE;
}
if (ret != WOLFSSL_SUCCESS) {
WOLFSSL_MSG("Error adding the name entry");
if (current->set == 0)
name->entrySz--;
return WOLFSSL_FAILURE;
@ -48074,6 +48110,46 @@ int wolfSSL_sk_X509_NAME_find(const WOLF_STACK_OF(WOLFSSL_X509_NAME) *sk,
return -1;
}
/* Name Entry */
WOLF_STACK_OF(WOLFSSL_X509_NAME_ENTRY)* wolfSSL_sk_X509_NAME_ENTRY_new(
wolf_sk_compare_cb cb)
{
WOLFSSL_STACK* sk = wolfSSL_sk_new_node(NULL);
if (sk != NULL) {
sk->type = STACK_TYPE_X509_NAME_ENTRY;
#ifdef OPENSSL_ALL
sk->comp = cb;
#else
(void)cb;
#endif
}
return sk;
}
int wolfSSL_sk_X509_NAME_ENTRY_push(WOLF_STACK_OF(WOLFSSL_X509_NAME_ENTRY)* sk,
WOLFSSL_X509_NAME_ENTRY* name_entry)
{
return wolfSSL_sk_push(sk, name_entry);
}
WOLFSSL_X509_NAME_ENTRY* wolfSSL_sk_X509_NAME_ENTRY_value(
const WOLF_STACK_OF(WOLFSSL_X509_NAME_ENTRY)* sk, int i)
{
return (WOLFSSL_X509_NAME_ENTRY*)wolfSSL_sk_value(sk, i);
}
int wolfSSL_sk_X509_NAME_ENTRY_num(const WOLF_STACK_OF(WOLFSSL_X509_NAME_ENTRY)* sk)
{
if (sk == NULL)
return BAD_FUNC_ARG;
return (int)sk->num;
}
void wolfSSL_sk_X509_NAME_ENTRY_free(WOLF_STACK_OF(WOLFSSL_X509_NAME_ENTRY)* sk)
{
wolfSSL_sk_free(sk);
}
#endif /* OPENSSL_EXTRA || HAVE_STUNNEL || WOLFSSL_NGINX ||
HAVE_LIGHTY || WOLFSSL_HAPROXY ||
WOLFSSL_OPENSSH || HAVE_SBLIM_SFCB */
@ -61204,10 +61280,19 @@ int wolfSSL_X509_STORE_CTX_set_purpose(WOLFSSL_X509_STORE_CTX *ctx,
{
(void)ctx;
(void)purpose;
WOLFSSL_STUB("wolfSSL_X509_STORE_CTX_set_purpose");
WOLFSSL_STUB("wolfSSL_X509_STORE_CTX_set_purpose (not implemented)");
return 0;
}
#endif
void wolfSSL_X509_STORE_CTX_set_flags(WOLFSSL_X509_STORE_CTX *ctx,
unsigned long flags)
{
(void)ctx;
(void)flags;
WOLFSSL_STUB("wolfSSL_X509_STORE_CTX_set_flags (not implemented)");
}
#endif /* !NO_WOLFSSL_STUB */
#endif /* WOLFSSL_QT || OPENSSL_ALL */
#endif /* OPENSSL_EXTRA */

21
tests/api.c
View File

@ -29551,7 +29551,7 @@ static void test_wolfSSL_X509_NAME(void)
tmp = buf;
AssertIntGT((sz = i2d_X509_NAME((X509_NAME*)a, &tmp)), 0);
if (sz > 0 && tmp == buf) {
printf("\nERROR - %s line %d failed with:", __FILE__, __LINE__); \
printf("\nERROR - %s line %d failed with:", __FILE__, __LINE__);
printf(" Expected pointer to be incremented\n");
abort();
}
@ -36534,7 +36534,11 @@ static void test_wolfSSL_check_domain(void)
FreeTcpReady(&ready);
/* Should have been called once for each cert in sent chain */
#ifdef WOLFSSL_VERIFY_CB_ALL_CERTS
AssertIntEQ(test_wolfSSL_check_domain_verify_count, 3);
#else
AssertIntEQ(test_wolfSSL_check_domain_verify_count, 1);
#endif
printf(resultFmt, passed);
}
@ -38063,6 +38067,9 @@ static void test_wolfSSL_X509_NAME_ENTRY(void)
X509_NAME* nm;
X509_NAME_ENTRY* entry;
unsigned char cn[] = "another name to add";
#ifdef OPENSSL_ALL
int i, names_len;
#endif
printf(testingFmt, "wolfSSL_X509_NAME_ENTRY()");
@ -38136,6 +38143,14 @@ static void test_wolfSSL_X509_NAME_ENTRY(void)
AssertIntEQ(X509_NAME_add_entry_by_NID(nm, NID_commonName, MBSTRING_UTF8,
cn, -1, -1, 0), SSL_SUCCESS);
#ifdef OPENSSL_ALL
/* stack of name entry */
AssertIntGT((names_len = sk_X509_NAME_ENTRY_num(nm->entries)), 0);
for (i=0; i<names_len; i++) {
AssertNotNull(entry = sk_X509_NAME_ENTRY_value(nm->entries, i));
}
#endif
#ifndef NO_BIO
BIO_free(bio);
#endif
@ -40481,7 +40496,9 @@ static void test_wolfSSL_SHA(void)
#if defined(OPENSSL_EXTRA) && !defined(HAVE_SELFTEST)
printf(testingFmt, "wolfSSL_SHA()");
#if !defined(NO_SHA) && defined(NO_OLD_SHA_NAMES)
#if !defined(NO_SHA) && defined(NO_OLD_SHA_NAMES) && \
(!defined(HAVE_FIPS) || \
(defined(HAVE_FIPS_VERSION) && HAVE_FIPS_VERSION > 2))
{
const unsigned char in[] = "abc";
unsigned char expected[] = "\xA9\x99\x3E\x36\x47\x06\x81\x6A\xBA\x3E"

6
wolfcrypt/src/evp.c
View File

@ -326,6 +326,12 @@ unsigned long wolfSSL_EVP_CIPHER_CTX_mode(const WOLFSSL_EVP_CIPHER_CTX *ctx)
return ctx->flags & WOLFSSL_EVP_CIPH_MODE;
}
unsigned long wolfSSL_EVP_CIPHER_CTX_flags(const WOLFSSL_EVP_CIPHER_CTX *ctx)
{
if (ctx == NULL) return 0;
return ctx->flags;
}
int wolfSSL_EVP_EncryptFinal(WOLFSSL_EVP_CIPHER_CTX *ctx,
unsigned char *out, int *outl)
{

4
wolfssl/internal.h
View File

@ -3823,6 +3823,7 @@ typedef enum {
STACK_TYPE_X509_OBJ = 14,
STACK_TYPE_DIST_POINT = 15,
STACK_TYPE_X509_CRL = 16,
STACK_TYPE_X509_NAME_ENTRY = 17,
} WOLF_STACK_TYPE;
struct WOLFSSL_STACK {
@ -3837,6 +3838,7 @@ struct WOLFSSL_STACK {
union {
WOLFSSL_X509* x509;
WOLFSSL_X509_NAME* name;
WOLFSSL_X509_NAME_ENTRY* name_entry;
WOLFSSL_X509_INFO* info;
WOLFSSL_BIO* bio;
WOLFSSL_ASN1_OBJECT* obj;
@ -3875,6 +3877,8 @@ struct WOLFSSL_X509_NAME {
#if defined(OPENSSL_ALL) || defined(WOLFSSL_NGINX) || defined(HAVE_LIGHTY)
byte raw[ASN_NAME_MAX];
int rawLen;
WOLF_STACK_OF(WOLFSSL_X509_NAME_ENTRY)* entries;
#endif
void* heap;
};

9
wolfssl/openssl/evp.h
View File

@ -245,6 +245,14 @@ enum {
NID_cmac = 894,
NID_dhKeyAgreement= 28,
NID_rc4 = 5,
NID_bf_cbc = 91,
NID_bf_ecb = 92,
NID_bf_cfb64 = 93,
NID_bf_ofb64 = 94,
NID_cast5_cbc = 108,
NID_cast5_ecb = 109,
NID_cast5_cfb64 = 110,
NID_cast5_ofb64 = 111,
EVP_PKEY_DH = NID_dhKeyAgreement,
EVP_PKEY_HMAC = NID_hmac,
EVP_PKEY_FALCON = 300, /* Randomly picked value. */
@ -708,6 +716,7 @@ WOLFSSL_API unsigned long WOLFSSL_CIPHER_mode(const WOLFSSL_EVP_CIPHER *cipher);
WOLFSSL_API unsigned long wolfSSL_EVP_CIPHER_flags(const WOLFSSL_EVP_CIPHER *cipher);
WOLFSSL_API void wolfSSL_EVP_CIPHER_CTX_set_flags(WOLFSSL_EVP_CIPHER_CTX *ctx, int flags);
WOLFSSL_API void wolfSSL_EVP_CIPHER_CTX_clear_flags(WOLFSSL_EVP_CIPHER_CTX *ctx, int flags);
WOLFSSL_API unsigned long wolfSSL_EVP_CIPHER_CTX_flags(const WOLFSSL_EVP_CIPHER_CTX *ctx);
WOLFSSL_API unsigned long wolfSSL_EVP_CIPHER_CTX_mode(const WOLFSSL_EVP_CIPHER_CTX *ctx);
WOLFSSL_API int wolfSSL_EVP_CIPHER_CTX_set_padding(WOLFSSL_EVP_CIPHER_CTX *c, int pad);
WOLFSSL_API int wolfSSL_EVP_add_digest(const WOLFSSL_EVP_MD *digest);

8
wolfssl/openssl/ssl.h
View File

@ -606,11 +606,17 @@ typedef STACK_OF(ACCESS_DESCRIPTION) AUTHORITY_INFO_ACCESS;
typedef WOLFSSL_X509_NAME_ENTRY X509_NAME_ENTRY;
#define X509_NAME_entry_count wolfSSL_X509_NAME_entry_count
#define X509_NAME_ENTRY_get_object wolfSSL_X509_NAME_ENTRY_get_object
#define X509_NAME_get_entry wolfSSL_X509_NAME_get_entry
#define X509_NAME_ENTRY_get_object wolfSSL_X509_NAME_ENTRY_get_object
#define X509_NAME_ENTRY_get_data wolfSSL_X509_NAME_ENTRY_get_data
#define X509_NAME_ENTRY_get_object wolfSSL_X509_NAME_ENTRY_get_object
#define sk_X509_NAME_ENTRY_new wolfSSL_sk_X509_NAME_ENTRY_new
#define sk_X509_NAME_ENTRY_push wolfSSL_sk_X509_NAME_ENTRY_push
#define sk_X509_NAME_ENTRY_num wolfSSL_sk_X509_NAME_ENTRY_num
#define sk_X509_NAME_ENTRY_value wolfSSL_sk_X509_NAME_ENTRY_value
#define sk_X509_NAME_ENTRY_free wolfSSL_sk_X509_NAME_ENTRY_free
#define X509_V_FLAG_CRL_CHECK WOLFSSL_CRL_CHECK
#define X509_V_FLAG_CRL_CHECK_ALL WOLFSSL_CRL_CHECKALL

7
wolfssl/openssl/x509_vfy.h
View File

@ -32,11 +32,12 @@
#if defined(WOLFSSL_QT) || defined(OPENSSL_ALL)
WOLFSSL_API int wolfSSL_X509_STORE_CTX_set_purpose(WOLFSSL_X509_STORE_CTX *ctx, int purpose);
WOLFSSL_API void wolfSSL_X509_STORE_CTX_set_flags(WOLFSSL_X509_STORE_CTX *ctx,
unsigned long flags);
#endif
#ifdef WOLFSSL_QT
#define X509_STORE_CTX_set_purpose wolfSSL_X509_STORE_CTX_set_purpose
#endif
#define X509_STORE_CTX_set_purpose wolfSSL_X509_STORE_CTX_set_purpose
#define X509_STORE_CTX_set_flags wolfSSL_X509_STORE_CTX_set_flags
#ifdef __cplusplus
} /* extern "C" */

10
wolfssl/ssl.h
View File

@ -4384,6 +4384,16 @@ WOLFSSL_API void wolfSSL_sk_X509_NAME_pop_free(WOLF_STACK_OF(WOLFSSL_X509_NAME)*
void (*f) (WOLFSSL_X509_NAME*));
WOLFSSL_API void wolfSSL_sk_X509_NAME_free(WOLF_STACK_OF(WOLFSSL_X509_NAME) *);
WOLFSSL_API WOLF_STACK_OF(WOLFSSL_X509_NAME_ENTRY)*
wolfSSL_sk_X509_NAME_ENTRY_new(wolf_sk_compare_cb cb);
WOLFSSL_API int wolfSSL_sk_X509_NAME_ENTRY_push(WOLF_STACK_OF(WOLFSSL_X509_NAME_ENTRY)* sk,
WOLFSSL_X509_NAME_ENTRY* name_entry);
WOLFSSL_API WOLFSSL_X509_NAME_ENTRY*
wolfSSL_sk_X509_NAME_ENTRY_value(const WOLF_STACK_OF(WOLFSSL_X509_NAME_ENTRY)* sk, int i);
WOLFSSL_API int wolfSSL_sk_X509_NAME_ENTRY_num(const WOLF_STACK_OF(WOLFSSL_X509_NAME_ENTRY)* sk);
WOLFSSL_API void wolfSSL_sk_X509_NAME_ENTRY_free(WOLF_STACK_OF(WOLFSSL_X509_NAME_ENTRY)* sk);
WOLFSSL_API int wolfSSL_sk_X509_OBJECT_num(const WOLF_STACK_OF(WOLFSSL_X509_OBJECT) *s);
WOLFSSL_API int wolfSSL_X509_NAME_print_ex(WOLFSSL_BIO* bio,WOLFSSL_X509_NAME* name,int indent,

3
wolfssl/wolfcrypt/asn.h
View File

@ -748,6 +748,9 @@ enum
NID_sha512 = 674,
NID_sha512_224 = 1094,
NID_sha512_256 = 1095,
NID_pkcs7_signed = 22,
NID_pkcs7_enveloped = 23,
NID_pkcs7_signedAndEnveloped = 24,
NID_pkcs9_unstructuredName = 49,
NID_pkcs9_contentType = 50, /* 1.2.840.113549.1.9.3 */
NID_pkcs9_challengePassword = 54,