implement libsodium support

 - Added support for using libsodium for encryption rather than OpenSSL
 - Removed AES-GCM tests with keys shorter than 256; libsodium only supports 256
 - Added a build with libsodium to the CI matrix

Signed-off-by: Andrew Simpson <[email protected]>

steven@ edited and rebased:

 - integrated with new USE_CRYPTO/USE_CRYPTO25519 options in CMake/meson
 - separated using libsodium for ed25519/curve25519 and AES/SHA256.
 - ensured libsodium simple crypto tests run on all builders instead of
   a single isolated builder.
 - prevented building with -DUSE_CRYPTO=libsodium for non-x86 hardware,
   as libsodium's AES implementation depends on AES-NI. it is still
   possible to configure with -DUSE_CRYPTO25519=libsodium on arbitrary
   hardware targets.

Fixes #88.

Signed-off-by: Steven Noonan <[email protected]>

Author: aiusepsi

.travis/build-cmake.sh

@@ -20,7 +20,7 @@ cmake_build() {
 
 cleanup() {
 	echo "Cleaning up CMake build directories" >&2
-	rm -rf build-{a,ub,t}san build-cmake build-cmake-ref
+	rm -rf build-{a,ub,t}san build-cmake{,-ref,-sodium{,25519}}
 }
 
 trap cleanup EXIT
@@ -35,6 +35,7 @@ CMAKE_ARGS=(
 )
 
 BUILD_SANITIZERS=${BUILD_SANITIZERS:-0}
+
 [[ $(uname -s) == MINGW* ]] && BUILD_SANITIZERS=0
 
 # Noticed that Clang's tsan and asan don't behave well on non-x86_64 Travis
@@ -48,6 +49,11 @@ BUILD_SANITIZERS=${BUILD_SANITIZERS:-0}
 # Foreign architecture docker containers don't support sanitizers.
 [[ $(uname -m) != x86_64 ]] && grep -q -e AuthenticAMD -e GenuineIntel /proc/cpuinfo && BUILD_SANITIZERS=0
 
+BUILD_LIBSODIUM=1
+
+# libsodium's AES implementation only works on x86_64
+[[ $(uname -m) != x86_64 ]] && BUILD_LIBSODIUM=0
+
 set -x
 
 # Build some tests with sanitizers
@@ -67,6 +73,16 @@ cmake_build build-cmake
 cmake_configure build-cmake-ref ${CMAKE_ARGS[@]} -DCMAKE_BUILD_TYPE=RelWithDebInfo -DUSE_CRYPTO25519=Reference ..
 cmake_build build-cmake-ref
 
+# Build binaries with libsodium for ed25519/curve25519 only
+cmake_configure build-cmake-sodium25519 ${CMAKE_ARGS[@]} -DCMAKE_BUILD_TYPE=RelWithDebInfo -DUSE_CRYPTO25519=libsodium ..
+cmake_build build-cmake-sodium25519
+
+# Build binaries with libsodium
+if [[ $BUILD_LIBSODIUM -ne 0 ]]; then
+	cmake_configure build-cmake-sodium ${CMAKE_ARGS[@]} -DCMAKE_BUILD_TYPE=RelWithDebInfo -DUSE_CRYPTO=libsodium -DUSE_CRYPTO25519=libsodium ..
+	cmake_build build-cmake-sodium
+fi
+
 # Build specific extended tests for code correctness validation
 if [[ $BUILD_SANITIZERS -ne 0 ]]; then
 	cmake_build build-asan test_connection test_crypto
@@ -78,6 +94,8 @@ fi
 
 # Run basic tests
 build-cmake-ref/tests/test_crypto
+[[ $BUILD_LIBSODIUM -ne 0 ]] && build-cmake-sodium/tests/test_crypto
+build-cmake-sodium25519/tests/test_crypto
 build-cmake/tests/test_crypto
 build-cmake/tests/test_connection
 

.travis/build-meson.sh

@@ -7,7 +7,7 @@ set -e
 
 cleanup() {
 	echo "Cleaning up Meson build directories" >&2
-	rm -rf build-meson build-meson-ref
+	rm -rf build-meson{,-ref,-sodium{,25519}}
 }
 
 trap cleanup EXIT
@@ -18,18 +18,29 @@ MESON_ARGS=(
 	-DWerror=true
 )
 
+BUILD_LIBSODIUM=1
+
+# libsodium's AES implementation only works on x86_64
+[[ $(uname -m) != x86_64 ]] && BUILD_LIBSODIUM=0
+
 set -x
 
 # Build lightweight test builds
 meson . build-meson ${MESON_ARGS[@]} --buildtype debugoptimized
 meson . build-meson-ref ${MESON_ARGS[@]} --buildtype debugoptimized -Duse_crypto25519=Reference
+[[ $BUILD_LIBSODIUM -ne 0 ]] && meson . build-meson-sodium ${MESON_ARGS[@]} --buildtype debugoptimized -Duse_crypto=libsodium -Duse_crypto25519=libsodium
+meson . build-meson-sodium25519 ${MESON_ARGS[@]} --buildtype debugoptimized -Duse_crypto25519=libsodium
 
 # Build all targets
 ninja -v -C build-meson
+[[ $BUILD_LIBSODIUM -ne 0 ]] && ninja -v -C build-meson-sodium
+ninja -v -C build-meson-sodium25519
 ninja -v -C build-meson-ref
 
 # Run basic tests
 build-meson/tests/test_crypto
+[[ $BUILD_LIBSODIUM -ne 0 ]] && build-meson-sodium/tests/test_crypto
+build-meson-sodium25519/tests/test_crypto
 build-meson-ref/tests/test_crypto
 
 set +x

.travis/install-alpine.sh

@@ -20,6 +20,7 @@ PACKAGES=(
 
 PACKAGES+=(protobuf-dev)
 PACKAGES+=(openssl-dev)
+PACKAGES+=(libsodium-dev)
 
 apk add "${PACKAGES[@]}"
 

.travis/install-archlinux.sh

@@ -15,6 +15,7 @@ PACKAGES=(
 
 PACKAGES+=(protobuf)
 PACKAGES+=(openssl)
+PACKAGES+=(libsodium)
 
 pacman --noconfirm -Sy "${PACKAGES[@]}"
 

.travis/install-fedora.sh

@@ -18,6 +18,7 @@ PACKAGES=(
 
 PACKAGES+=(protobuf-compiler protobuf-devel)
 PACKAGES+=(openssl-devel)
+PACKAGES+=(libsodium-devel)
 
 dnf install -y "${PACKAGES[@]}"
 

.travis/install-ubuntu.sh

@@ -12,6 +12,7 @@ PACKAGES=(build-essential pkg-config ccache cmake meson clang)
 
 PACKAGES+=(libprotobuf-dev protobuf-compiler)
 PACKAGES+=(libssl-dev)
+PACKAGES+=(libsodium-dev)
 
 apt-get install -y "${PACKAGES[@]}"
 

CMakeLists.txt

@@ -33,7 +33,7 @@ option(LIGHT_TESTS "Use smaller/shorter tests for simple integration testing (e.
 #
 # Primary crypto library (for AES, SHA256, etc)
 #
-set(useCryptoOptions OpenSSL BCrypt)
+set(useCryptoOptions OpenSSL libsodium BCrypt)
 set(USE_CRYPTO "OpenSSL" CACHE STRING "Crypto library to use for AES/SHA256")
 set_property(CACHE USE_CRYPTO PROPERTY STRINGS ${useCryptoOptions})
 
@@ -74,7 +74,7 @@ endif()
 #
 # Secondary crypto library (for ed25519/curve25519).
 #
-set(useCrypto25519Options OpenSSL Reference)
+set(useCrypto25519Options OpenSSL libsodium Reference)
 set(USE_CRYPTO25519 "${useCrypto25519Default}" CACHE STRING "Crypto library to use for ed25519/curve25519")
 set_property(CACHE USE_CRYPTO25519 PROPERTY STRINGS ${useCrypto25519Options})
 
@@ -107,6 +107,16 @@ if(USE_CRYPTO25519 STREQUAL "OpenSSL" AND NOT OPENSSL_HAS_25519_RAW)
 	message(FATAL_ERROR "This version of OpenSSL does not support ed25519/curve25519. Please use -DUSE_CRYPTO25519=Reference or upgrade OpenSSL to 1.1.1 or later")
 endif()
 
+if(USE_CRYPTO STREQUAL "libsodium" OR USE_CRYPTO25519 STREQUAL "libsodium")
+	find_package(sodium REQUIRED)
+endif()
+
+if(USE_CRYPTO STREQUAL "libsodium")
+	if(NOT CMAKE_SYSTEM_PROCESSOR MATCHES "amd64.*|x86_64.*|AMD64.*|i686.*|i386.*|x86.*")
+		message(FATAL_ERROR "-DUSE_CRYPTO=libsodium invalid, libsodium AES implementation only works on x86/x86_64 CPUs")
+	endif()
+endif()
+
 add_subdirectory(examples)
 add_subdirectory(src)
 add_subdirectory(tests)