Skip to content

Commit 424637f

Browse files
cconloncconlon
authored
Merge pull request #115 from SparkiDev/we_cms
CMS: Add support for CMS/PKCS#7
2 parents bd2368a + c27c882 commit 424637f

File tree

9 files changed

+471
-60
lines changed

9 files changed

+471
-60
lines changed

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ sudo make install
5858
git clone https://github.com/wolfssl/wolfssl.git
5959
cd wolfssl
6060
./autogen.sh
61-
./configure --enable-cmac --enable-keygen --enable-sha --enable-des3 --enable-aesctr --enable-aesccm CPPFLAGS="-DHAVE_AES_ECB -DWOLFSSL_AES_DIRECT -DWC_RSA_NO_PADDING -DWOLFSSL_PUBLIC_MP -DECC_MIN_KEY_SZ=192 -DWOLFSSL_PSS_LONG_SALT -DWOLFSSL_PSS_SALT_LEN_DISCOVER"
61+
./configure --enable-cmac --enable-keygen --enable-sha --enable-des3 --enable-aesctr --enable-aesccm --enable-x963kdf CPPFLAGS="-DHAVE_AES_ECB -DWOLFSSL_AES_DIRECT -DWC_RSA_NO_PADDING -DWOLFSSL_PUBLIC_MP -DECC_MIN_KEY_SZ=192 -DWOLFSSL_PSS_LONG_SALT -DWOLFSSL_PSS_SALT_LEN_DISCOVER"
6262
make
6363
sudo make install
6464
```

‎include/wolfengine/we_openssl_bc.h‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -173,6 +173,9 @@ size_t EC_POINT_point2buf(const EC_GROUP *group, const EC_POINT *point,
173173
#ifndef EVP_PKEY_HKDEF_MODE_EXPAND_ONLY
174174
#define EVP_PKEY_HKDEF_MODE_EXPAND_ONLY 2
175175
#endif
176+
#ifndef EVP_PKEY_ECDH_KDF_X9_63
177+
#define EVP_PKEY_ECDH_KDF_X9_63 EVP_PKEY_ECDH_KDF_X9_62
178+
#endif
176179

177180
const BIGNUM *DH_get0_p(const DH *dh);
178181
const BIGNUM *DH_get0_g(const DH *dh);

‎openssl_patches/1.1.1b/tests/openssl_111b.patch‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
diff --git a/apps/openssl.c b/apps/openssl.c
2+
index a872e2c5..6fe79d59 100644
3+
--- a/apps/openssl.c
4+
+++ b/apps/openssl.c
5+
@@ -127,6 +127,20 @@ int main(int argc, char *argv[])
6+
const char *prompt;
7+
ARGS arg;
8+
int first, n, i, ret = 0;
9+
+ ENGINE *e;
10+
+
11+
+ ENGINE_load_dynamic();
12+
+ e = ENGINE_by_id("libwolfengine");
13+
+ if (e == NULL) {
14+
+ printf("Failed to find wolfEngine.\n");
15+
+ return 1;
16+
+ }
17+
+ if (ENGINE_ctrl_cmd(e, "enable_debug", 1, NULL, NULL, 0) != 1) {
18+
+ printf("Failed to enable wolfEngine debug logging.\n");
19+
+ return 1;
20+
+ }
21+
+ ENGINE_set_default(e, ENGINE_METHOD_ALL);
22+
+
23+
24+
arg.argv = NULL;
25+
arg.size = 0;
26+
@@ -260,12 +274,14 @@ int main(int argc, char *argv[])
27+
28+
BIO_free(bio_in);
29+
BIO_free_all(bio_out);
30+
+ ENGINE_finish(e);
31+
apps_shutdown();
32+
#ifndef OPENSSL_NO_CRYPTO_MDEBUG
33+
if (CRYPTO_mem_leaks(bio_err) <= 0)
34+
ret = 1;
35+
#endif
36+
BIO_free(bio_err);
37+
+ ENGINE_cleanup();
38+
EXIT(ret);
39+
}
40+

‎openssl_patches/1.1.1b/tests/test_cms.txt_11b.patch‎

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
diff --git a/test/recipes/80-test_cms.t b/test/recipes/80-test_cms.t
2+
index f038bea3..dc8574ed 100644
3+
--- a/test/recipes/80-test_cms.t
4+
+++ b/test/recipes/80-test_cms.t
5+
@@ -137,9 +137,9 @@ my @smime_pkcs7_tests = (
6+
"-CAfile", catfile($smdir, "smroot.pem"), "-out", "smtst.txt" ]
7+
],
8+
9+
- [ "enveloped content test streaming S/MIME format, DES, 3 recipients",
10+
+ [ "enveloped content test streaming S/MIME format, AES-128, 3 recipients",
11+
[ "-encrypt", "-in", $smcont,
12+
- "-stream", "-out", "test.cms",
13+
+ "-aes128", "-stream", "-out", "test.cms",
14+
catfile($smdir, "smrsa1.pem"),
15+
catfile($smdir, "smrsa2.pem"),
16+
catfile($smdir, "smrsa3.pem") ],
17+
@@ -147,9 +147,9 @@ my @smime_pkcs7_tests = (
18+
"-in", "test.cms", "-out", "smtst.txt" ]
19+
],
20+
21+
- [ "enveloped content test streaming S/MIME format, DES, 3 recipients, 3rd used",
22+
+ [ "enveloped content test streaming S/MIME format, AES-128, 3 recipients, 3rd used",
23+
[ "-encrypt", "-in", $smcont,
24+
- "-stream", "-out", "test.cms",
25+
+ "-aes128", "-stream", "-out", "test.cms",
26+
catfile($smdir, "smrsa1.pem"),
27+
catfile($smdir, "smrsa2.pem"),
28+
catfile($smdir, "smrsa3.pem") ],
29+
@@ -157,9 +157,9 @@ my @smime_pkcs7_tests = (
30+
"-in", "test.cms", "-out", "smtst.txt" ]
31+
],
32+
33+
- [ "enveloped content test streaming S/MIME format, DES, 3 recipients, key only used",
34+
+ [ "enveloped content test streaming S/MIME format, AES-128, 3 recipients, key only used",
35+
[ "-encrypt", "-in", $smcont,
36+
- "-stream", "-out", "test.cms",
37+
+ "-aes128", "-stream", "-out", "test.cms",
38+
catfile($smdir, "smrsa1.pem"),
39+
catfile($smdir, "smrsa2.pem"),
40+
catfile($smdir, "smrsa3.pem") ],
41+
@@ -219,9 +219,9 @@ my @smime_cms_tests = (
42+
"-CAfile", catfile($smdir, "smroot.pem") ]
43+
],
44+
45+
- [ "enveloped content test streaming S/MIME format, DES, 3 recipients, keyid",
46+
+ [ "enveloped content test streaming S/MIME format, AES-128, 3 recipients, keyid",
47+
[ "-encrypt", "-in", $smcont,
48+
- "-stream", "-out", "test.cms", "-keyid",
49+
+ "-aes128", "-stream", "-out", "test.cms", "-keyid",
50+
catfile($smdir, "smrsa1.pem"),
51+
catfile($smdir, "smrsa2.pem"),
52+
catfile($smdir, "smrsa3.pem") ],
53+
@@ -324,43 +324,43 @@ my @smime_cms_param_tests = (
54+
"-CAfile", catfile($smdir, "smroot.pem"), "-out", "smtst.txt" ]
55+
],
56+
57+
- [ "enveloped content test streaming S/MIME format, DES, OAEP default parameters",
58+
+ [ "enveloped content test streaming S/MIME format, AES-128, OAEP default parameters",
59+
[ "-encrypt", "-in", $smcont,
60+
- "-stream", "-out", "test.cms",
61+
+ "-aes128", "-stream", "-out", "test.cms",
62+
"-recip", catfile($smdir, "smrsa1.pem"), "-keyopt", "rsa_padding_mode:oaep" ],
63+
[ "-decrypt", "-recip", catfile($smdir, "smrsa1.pem"),
64+
"-in", "test.cms", "-out", "smtst.txt" ]
65+
],
66+
67+
- [ "enveloped content test streaming S/MIME format, DES, OAEP SHA256",
68+
+ [ "enveloped content test streaming S/MIME format, AES-128, OAEP SHA256",
69+
[ "-encrypt", "-in", $smcont,
70+
- "-stream", "-out", "test.cms",
71+
+ "-aes128", "-stream", "-out", "test.cms",
72+
"-recip", catfile($smdir, "smrsa1.pem"), "-keyopt", "rsa_padding_mode:oaep",
73+
"-keyopt", "rsa_oaep_md:sha256" ],
74+
[ "-decrypt", "-recip", catfile($smdir, "smrsa1.pem"),
75+
"-in", "test.cms", "-out", "smtst.txt" ]
76+
],
77+
78+
- [ "enveloped content test streaming S/MIME format, DES, ECDH",
79+
+ [ "enveloped content test streaming S/MIME format, AES-128, ECDH",
80+
[ "-encrypt", "-in", $smcont,
81+
- "-stream", "-out", "test.cms",
82+
+ "-aes128", "-stream", "-out", "test.cms",
83+
"-recip", catfile($smdir, "smec1.pem") ],
84+
[ "-decrypt", "-recip", catfile($smdir, "smec1.pem"),
85+
"-in", "test.cms", "-out", "smtst.txt" ]
86+
],
87+
88+
- [ "enveloped content test streaming S/MIME format, DES, ECDH, 2 recipients, key only used",
89+
+ [ "enveloped content test streaming S/MIME format, AES-128, ECDH, 2 recipients, key only used",
90+
[ "-encrypt", "-in", $smcont,
91+
- "-stream", "-out", "test.cms",
92+
+ "-aes128", "-stream", "-out", "test.cms",
93+
catfile($smdir, "smec1.pem"),
94+
catfile($smdir, "smec3.pem") ],
95+
[ "-decrypt", "-inkey", catfile($smdir, "smec3.pem"),
96+
"-in", "test.cms", "-out", "smtst.txt" ]
97+
],
98+
99+
- [ "enveloped content test streaming S/MIME format, ECDH, DES, key identifier",
100+
+ [ "enveloped content test streaming S/MIME format, ECDH, AES-128, key identifier",
101+
[ "-encrypt", "-keyid", "-in", $smcont,
102+
- "-stream", "-out", "test.cms",
103+
+ "-aes128", "-stream", "-out", "test.cms",
104+
"-recip", catfile($smdir, "smec1.pem") ],
105+
[ "-decrypt", "-recip", catfile($smdir, "smec1.pem"),
106+
"-in", "test.cms", "-out", "smtst.txt" ]
107+
@@ -374,14 +374,14 @@ my @smime_cms_param_tests = (
108+
"-in", "test.cms", "-out", "smtst.txt" ]
109+
],
110+
111+
- [ "enveloped content test streaming S/MIME format, ECDH, K-283, cofactor DH",
112+
- [ "-encrypt", "-in", $smcont,
113+
- "-stream", "-out", "test.cms",
114+
- "-recip", catfile($smdir, "smec2.pem"), "-aes128",
115+
- "-keyopt", "ecdh_kdf_md:sha256", "-keyopt", "ecdh_cofactor_mode:1" ],
116+
- [ "-decrypt", "-recip", catfile($smdir, "smec2.pem"),
117+
- "-in", "test.cms", "-out", "smtst.txt" ]
118+
- ],
119+
+# [ "enveloped content test streaming S/MIME format, ECDH, K-283, cofactor DH",
120+
+# [ "-encrypt", "-in", $smcont,
121+
+# "-stream", "-out", "test.cms",
122+
+# "-recip", catfile($smdir, "smec2.pem"), "-aes128",
123+
+# "-keyopt", "ecdh_kdf_md:sha256", "-keyopt", "ecdh_cofactor_mode:1" ],
124+
+# [ "-decrypt", "-recip", catfile($smdir, "smec2.pem"),
125+
+# "-in", "test.cms", "-out", "smtst.txt" ]
126+
+# ],
127+
128+
[ "enveloped content test streaming S/MIME format, X9.42 DH",
129+
[ "-encrypt", "-in", $smcont,

‎scripts/openssl-unit-tests.sh‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -274,7 +274,7 @@ run_patched_tests() {
274274
TEST="$TEST evptests.txt"
275275
fi
276276
# main is the common file for 1.1.1b tests
277-
if [ "$TEST" == "main" -o "$TEST" == "apps" ]; then
277+
if [ "$TEST" == "main" -o "$TEST" == "apps" -o "$TEST" == "openssl" ]; then
278278
continue
279279
fi
280280
if [[ "$TEST" == *".conf.in"* ]]; then
@@ -338,6 +338,7 @@ test_openssl_111b() {
338338
run_patched_tests
339339

340340
run_test "clienthellotest session.pem"
341+
run_test "x509_dup_cert_test certs/leaf.pem"
341342

342343
# test/recipes/15-test_genrsa.t
343344
for BITS in 2048 3072 4096
@@ -361,6 +362,9 @@ test_openssl_111b() {
361362
run_111recipe "test_ssl_old"
362363
run_111recipe "test_ssl_test_ctx"
363364
run_111recipe "test_sslcorrupt"
365+
run_111recipe "test_x509_store"
366+
run_111recipe "test_cms"
367+
run_111recipe "test_cmsapi"
364368

365369
# individual test runs (recipe is preferred)
366370
# for SSL_TEST in "01-simple.conf" "02-protocol-version.conf" \

‎src/we_aes_block.c‎

Lines changed: 20 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,8 @@ typedef struct we_AesBlock
3838
unsigned int init:1;
3939
/** Flag to indicate whether we are doing encrypt (1) or decrpyt (0). */
4040
unsigned int enc:1;
41+
/** Flag to indicate whether iv has been set. */
42+
unsigned int ivSet:1;
4143
} we_AesBlock;
4244

4345
#endif
@@ -117,6 +119,7 @@ static int we_aes_cbc_init(EVP_CIPHER_CTX *ctx, const unsigned char *key,
117119
WOLFENGINE_ERROR_FUNC(WE_LOG_CIPHER, "wc_AesSetIV", rc);
118120
ret = 0;
119121
}
122+
aes->ivSet = (ret == 1);
120123
}
121124
}
122125

@@ -352,7 +355,8 @@ static int we_aes_cbc_decrypt(we_AesBlock* aes, unsigned char *out,
352355
static int we_aes_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
353356
const unsigned char *in, size_t len)
354357
{
355-
int ret;
358+
int ret = 1;
359+
int rc;
356360
we_AesBlock* aes;
357361

358362
WOLFENGINE_ENTER(WE_LOG_CIPHER, "we_aes_cbc_cipher");
@@ -366,11 +370,22 @@ static int we_aes_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
366370
"EVP_CIPHER_CTX_get_cipher_data", aes);
367371
ret = -1;
368372
}
369-
else if (aes->enc) {
370-
ret = we_aes_cbc_encrypt(aes, out, in, len);
373+
if ((ret == 1) && (!aes->ivSet)) {
374+
WOLFENGINE_MSG(WE_LOG_CIPHER, "Setting AES IV");
375+
rc = wc_AesSetIV(&aes->aes, EVP_CIPHER_CTX_iv_noconst(ctx));
376+
if (rc != 0) {
377+
WOLFENGINE_ERROR_FUNC(WE_LOG_CIPHER, "wc_AesSetIV", rc);
378+
ret = 0;
379+
}
380+
aes->ivSet = (ret == 1);
371381
}
372-
else {
373-
ret = we_aes_cbc_decrypt(aes, out, in, len);
382+
if (ret == 1) {
383+
if (aes->enc) {
384+
ret = we_aes_cbc_encrypt(aes, out, in, len);
385+
}
386+
else {
387+
ret = we_aes_cbc_decrypt(aes, out, in, len);
388+
}
374389
}
375390

376391
WOLFENGINE_LEAVE(WE_LOG_CIPHER, "we_aes_cbc_cipher", ret);

‎src/we_des3_cbc.c‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,8 @@ typedef struct we_Des3Cbc
3939
unsigned int init:1;
4040
/** Flag to indicate whether we are doing encrypt (1) or decrpyt (0). */
4141
unsigned int enc:1;
42+
/** Flag to indicate whether IV has been set. */
43+
unsigned int ivSet:1;
4244
} we_Des3Cbc;
4345

4446
/**
@@ -105,6 +107,7 @@ static int we_des3_cbc_init(EVP_CIPHER_CTX *ctx, const unsigned char *key,
105107
WOLFENGINE_ERROR_FUNC(WE_LOG_CIPHER, "wc_Des3_SetIV", rc);
106108
ret = 0;
107109
}
110+
des3->ivSet = (ret == 1);
108111
}
109112
}
110113

@@ -222,6 +225,7 @@ static int we_des3_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
222225
const unsigned char *in, size_t len)
223226
{
224227
int ret = 1;
228+
int rc;
225229
we_Des3Cbc* des3;
226230

227231
WOLFENGINE_ENTER(WE_LOG_CIPHER, "we_des3_cbc_cipher");
@@ -235,6 +239,15 @@ static int we_des3_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
235239
"EVP_CIPHER_CTX_get_cipher_data", des3);
236240
ret = 0;
237241
}
242+
if ((ret == 1) && (!des3->ivSet)) {
243+
WOLFENGINE_MSG(WE_LOG_CIPHER, "Setting 3DES IV");
244+
rc = wc_Des3_SetIV(&des3->des3, EVP_CIPHER_CTX_iv_noconst(ctx));
245+
if (rc != 0) {
246+
WOLFENGINE_ERROR_FUNC(WE_LOG_CIPHER, "wc_Des3_SetIV", rc);
247+
ret = 0;
248+
}
249+
des3->ivSet = (ret == 1);
250+
}
238251
if (ret == 1) {
239252
if (des3->enc) {
240253
ret = we_des3_cbc_encrypt(ctx, des3, out, in, len);

0 commit comments

Comments
 (0)