Skip to content

Commit 897a6a6

Browse files
LinuxJediLinuxJedi
committed
Add wolfBoot testing to wolfPKCS11
wolfBoot implements its own storage, we need to make sure we don't break it.
1 parent bfd3f7a commit 897a6a6

19 files changed

+599
-49
lines changed

‎.github/workflows/wolfboot-build.yml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
name: Build wolfBoot integration
2+
3+
on:
4+
push:
5+
branches: [main, master]
6+
pull_request:
7+
branches: [main, master]
8+
workflow_dispatch:
9+
10+
jobs:
11+
build:
12+
name: Build wolfPKCS11 with wolfBoot store
13+
runs-on: ubuntu-24.04
14+
env:
15+
DEBIAN_FRONTEND: noninteractive
16+
LD_LIBRARY_PATH: /usr/local/lib
17+
PKG_CONFIG_PATH: /usr/local/lib/pkgconfig
18+
WOLFSSL_REF: v5.8.0-stable
19+
WOLFBOOT_REF: master
20+
WOLFBOOT_DIR: ${{ runner.temp }}/wolfBoot
21+
steps:
22+
- name: Checkout repository
23+
uses: actions/checkout@v4
24+
25+
- name: Install dependencies
26+
run: |
27+
sudo apt-get update
28+
sudo apt-get install -y --no-install-recommends \
29+
autoconf \
30+
automake \
31+
build-essential \
32+
ca-certificates \
33+
git \
34+
libssl-dev \
35+
libtool \
36+
make \
37+
pkg-config \
38+
python3 \
39+
gdb
40+
41+
- name: Build and install wolfSSL
42+
run: |
43+
git clone --depth 1 --branch "${WOLFSSL_REF}" https://github.com/wolfSSL/wolfssl.git /tmp/wolfssl
44+
cd /tmp/wolfssl
45+
./autogen.sh
46+
./configure --enable-debug --enable-aescfb --enable-cryptocb --enable-rsapss --enable-keygen \
47+
--enable-pwdbased --enable-scrypt "C_EXTRA_FLAGS=-DWOLFSSL_PUBLIC_MP -DWC_RSA_DIRECT -DHAVE_AES_ECB -DHAVE_AES_KEYWRAP"
48+
make -j"$(nproc)"
49+
sudo make install
50+
sudo ldconfig
51+
52+
- name: Fetch wolfBoot sources
53+
run: |
54+
git clone --depth 1 --branch "${WOLFBOOT_REF}" https://github.com/wolfSSL/wolfBoot.git "${WOLFBOOT_DIR}"
55+
56+
- name: Build wolfPKCS11
57+
run: |
58+
./autogen.sh
59+
./configure --enable-debug --with-wolfboot="${WOLFBOOT_DIR}" CPPFLAGS="-I/usr/local/include" LDFLAGS="-L/usr/local/lib"
60+
make -j"$(nproc)"
61+
62+
- name: Run tests
63+
run: make test

‎Docker/include.am‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,3 @@
11
EXTRA_DIST+= Docker/packaging/debian/Dockerfile
2+
EXTRA_DIST+= Docker/firefox/Dockerfile
3+
EXTRA_DIST+= Docker/wolfboot/Dockerfile

‎Docker/wolfboot/Dockerfile‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
FROM ubuntu:24.04
2+
3+
ARG WOLFSSL_REF=v5.8.0-stable
4+
ARG WOLFBOOT_REF=master
5+
6+
ENV DEBIAN_FRONTEND=noninteractive
7+
ENV LD_LIBRARY_PATH=/usr/local/lib
8+
ENV PKG_CONFIG_PATH=/usr/local/lib/pkgconfig
9+
10+
RUN apt-get update && apt-get install -y --no-install-recommends \
11+
autoconf \
12+
automake \
13+
build-essential \
14+
ca-certificates \
15+
git \
16+
libssl-dev \
17+
libtool \
18+
make \
19+
pkg-config \
20+
python3 \
21+
gdb \
22+
&& rm -rf /var/lib/apt/lists/*
23+
24+
# Build and install wolfSSL
25+
RUN git clone --depth 1 --branch ${WOLFSSL_REF} https://github.com/wolfSSL/wolfssl.git /tmp/wolfssl \
26+
&& cd /tmp/wolfssl \
27+
&& ./autogen.sh \
28+
&& ./configure --enable-debug --enable-aescfb --enable-cryptocb --enable-rsapss --enable-keygen \
29+
--enable-pwdbased --enable-scrypt "C_EXTRA_FLAGS=-DWOLFSSL_PUBLIC_MP -DWC_RSA_DIRECT -DHAVE_AES_ECB -DHAVE_AES_KEYWRAP" \
30+
&& make -j"$(nproc)" \
31+
&& make install \
32+
&& ldconfig \
33+
&& rm -rf /tmp/wolfssl
34+
35+
# Fetch wolfBoot sources that provide the custom store implementation
36+
RUN git clone --depth 1 --branch ${WOLFBOOT_REF} https://github.com/wolfSSL/wolfBoot.git /opt/wolfBoot
37+
38+
WORKDIR /wolfpkcs11
39+
COPY . /wolfpkcs11
40+
41+
RUN ./autogen.sh \
42+
&& ./configure --enable-debug --with-wolfboot=/opt/wolfBoot CPPFLAGS="-I/usr/local/include" LDFLAGS="-L/usr/local/lib" \
43+
&& make -j"$(nproc)"
44+
45+
#RUN make check

‎README.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,11 @@ Enables debugging printf's for store.
7373
Removes default implementation of storage functions.
7474
See wolfpkcs11/store.h for prototypes of functions to implement.
7575

76+
To build and test with the wolfBoot storage backend, configure with
77+
`./configure --with-wolfboot=/path/to/wolfBoot`. This enables
78+
`WOLFPKCS11_CUSTOM_STORE` automatically and links against the wolfBoot
79+
implementation of the store API.
80+
7681
#### Define WOLFPKCS11_KEYPAIR_GEN_COMMON_LABEL
7782

7883
Sets the private key's label against the public key when generating key pairs.

‎configure.ac‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ AC_PROG_INSTALL
3131
AC_ARG_PROGRAM
3232
AC_CONFIG_MACRO_DIR([m4])
3333
AC_CONFIG_HEADERS([wolfpkcs11/config.h])
34+
m4_ifndef([AS_MESSAGE_LOG_FD],[m4_define([AS_MESSAGE_LOG_FD],[0])])
35+
m4_pattern_allow([AS_MESSAGE_LOG_FD])
3436

3537
# shared library versioning
3638
# The three numbers in the libpkcs11.so.*.*.* file name. Unfortunately
@@ -78,6 +80,36 @@ AC_CHECK_SIZEOF([long], 4)
7880
AC_CHECK_FUNCS([gethostbyname getaddrinfo gettimeofday inet_ntoa memset socket getpid])
7981
AC_CHECK_LIB([network],[socket])
8082

83+
WOLFBOOT_CPPFLAGS=""
84+
WOLFBOOT_STORE_ENABLED=no
85+
86+
AC_ARG_WITH([wolfboot],
87+
[AS_HELP_STRING([--with-wolfboot=PATH],
88+
[Enable wolfBoot-backed token storage using the wolfBoot sources located at PATH])],
89+
[with_wolfboot="$withval"],
90+
[with_wolfboot=""])
91+
92+
AS_IF([test "x$with_wolfboot" = "xyes"],
93+
[AC_MSG_ERROR([--with-wolfboot requires a path to the wolfBoot source tree])])
94+
95+
AS_IF([test "x$with_wolfboot" != "x" && test "x$with_wolfboot" != "xno"],
96+
[if test ! -d "$with_wolfboot"; then
97+
echo "configure: error: wolfBoot source directory $with_wolfboot not found" >&2
98+
exit 1
99+
fi
100+
if test ! -f "$with_wolfboot/src/pkcs11_store.c"; then
101+
echo "configure: error: wolfBoot PKCS#11 store source not found in $with_wolfboot/src" >&2
102+
exit 1
103+
fi
104+
AC_DEFINE([HAVE_WOLFBOOT_STORE], [1],
105+
[Define to 1 if wolfBoot custom storage support is enabled])
106+
AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFPKCS11_CUSTOM_STORE -DWOLFPKCS11_WOLFBOOT_STORE"
107+
WOLFBOOT_CPPFLAGS="-I$with_wolfboot/include -I$with_wolfboot/src -I$with_wolfboot/tools/unit-tests"
108+
WOLFBOOT_STORE_ENABLED=yes])
109+
110+
AM_CONDITIONAL([HAVE_WOLFBOOT_STORE], [test "x$WOLFBOOT_STORE_ENABLED" = "xyes"])
111+
AC_SUBST([WOLFBOOT_CPPFLAGS])
112+
81113
# DEBUG
82114
DEBUG_CFLAGS="-g -O0 -DDEBUG_WOLFPKCS11"
83115

‎src/crypto.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6411,7 +6411,6 @@ CK_RV C_GenerateKey(CK_SESSION_HANDLE hSession,
64116411
case CKP_PKCS5_PBKD2_HMAC_SHA512:
64126412
hashType = WC_SHA512;
64136413
break;
6414-
#endif
64156414
#ifndef WOLFSSL_NOSHA512_224
64166415
case CKP_PKCS5_PBKD2_HMAC_SHA512_224:
64176416
hashType = WC_SHA512_224;
@@ -6421,6 +6420,7 @@ CK_RV C_GenerateKey(CK_SESSION_HANDLE hSession,
64216420
case CKP_PKCS5_PBKD2_HMAC_SHA512_256:
64226421
hashType = WC_SHA512_256;
64236422
break;
6423+
#endif
64246424
#endif
64256425
default:
64266426
return CKR_MECHANISM_PARAM_INVALID;

‎src/include.am‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,13 @@ src_libwolfpkcs11_la_SOURCES = \
1010
src/slot.c \
1111
src/crypto.c
1212

13+
if HAVE_WOLFBOOT_STORE
14+
src_libwolfpkcs11_la_SOURCES += \
15+
src/wolfboot_store_adapter.c
16+
endif
17+
1318
src_libwolfpkcs11_la_CFLAGS = -DBUILDING_WOLFPKCS11 $(AM_CFLAGS)
14-
src_libwolfpkcs11_la_CPPFLAGS = -DBUILDING_WOLFPKCS11 $(AM_CPPFLAGS)
19+
src_libwolfpkcs11_la_CPPFLAGS = -DBUILDING_WOLFPKCS11 $(AM_CPPFLAGS) $(WOLFBOOT_CPPFLAGS)
1520
src_libwolfpkcs11_la_LDFLAGS = ${AM_LDFLAGS} -no-undefined -version-number ${WOLFPKCS11_LIBRARY_VERSION}
1621

1722
#src_libwolfpkcs11_la_DEPENDENCIES =

‎src/internal.c‎

Lines changed: 16 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -4739,14 +4739,17 @@ static int wp11_Object_Encode(WP11_Object* object, int protect)
47394739
{
47404740
int ret;
47414741

4742+
int is_plain_class;
4743+
47424744
#ifdef WOLFPKCS11_NSS
4743-
if ((object->objClass == CKO_CERTIFICATE) ||
4744-
(object->objClass == CKO_NSS_TRUST))
4745+
is_plain_class = (object->objClass == CKO_CERTIFICATE) ||
4746+
(object->objClass == CKO_NSS_TRUST) ||
4747+
(object->objClass == CKO_DATA);
47454748
#else
4746-
if (object->objClass == CKO_CERTIFICATE)
4749+
is_plain_class = (object->objClass == CKO_CERTIFICATE) ||
4750+
(object->objClass == CKO_DATA);
47474751
#endif
4748-
ret = 0;
4749-
else if (object->objClass == CKO_DATA) {
4752+
if (is_plain_class) {
47504753
ret = 0;
47514754
}
47524755
else {
@@ -8957,15 +8960,14 @@ int WP11_Object_GetAttr(WP11_Object* object, CK_ATTRIBUTE_TYPE type, byte* data,
89578960
ret = NOT_AVAILABLE_E;
89588961
#endif
89598962
}
8960-
else if (object->objClass == CKO_SECRET_KEY) {
89618963
#ifdef HAVE_AESECB
8964+
else if (object->objClass == CKO_SECRET_KEY) {
89628965
ret = GetEcbCheckValue(object, data, len);
8963-
#else
8964-
ret = NOT_AVAILABLE_E;
8965-
#endif
89668966
}
8967-
else
8967+
#endif
8968+
else {
89688969
ret = NOT_AVAILABLE_E;
8970+
}
89698971
break;
89708972

89718973
default:
@@ -9298,11 +9300,9 @@ int WP11_Object_SetAttr(WP11_Object* object, CK_ATTRIBUTE_TYPE type, byte* data,
92989300
}
92999301
break;
93009302
case CKA_VALUE:
9301-
if (object->objClass == CKO_CERTIFICATE) {
9302-
break; /* Handled in WP11_Object_SetCert */
9303-
}
9304-
else if (object->objClass == CKO_DATA) {
9305-
break; /* Handled in WP11_Object_SetDataObject */
9303+
if ((object->objClass == CKO_CERTIFICATE) ||
9304+
(object->objClass == CKO_DATA)) {
9305+
break; /* Handled in WP11_Object_SetCert/DataObject */
93069306
}
93079307
switch (object->type) {
93089308
#ifdef HAVE_ECC
@@ -9325,18 +9325,8 @@ int WP11_Object_SetAttr(WP11_Object* object, CK_ATTRIBUTE_TYPE type, byte* data,
93259325
}
93269326
break;
93279327
case CKA_APPLICATION:
9328-
if (object->objClass == CKO_DATA) {
9329-
/* Handled in WP11_Object_DataObject */
9330-
}
9331-
else {
9332-
ret = BAD_FUNC_ARG;
9333-
}
9334-
break;
93359328
case CKA_OBJECT_ID:
9336-
if (object->objClass == CKO_DATA) {
9337-
/* Handled in WP11_Object_DataObject */
9338-
}
9339-
else {
9329+
if (object->objClass != CKO_DATA) {
93409330
ret = BAD_FUNC_ARG;
93419331
}
93429332
break;

0 commit comments

Comments
 (0)