Skip to content

Commit a091ed9

Browse files
douzzerdouzzer
authored
Merge pull request #9590 from philljj/fips_bsdkm
Fips bsdkm
2 parents 2d39410 + 99527be commit a091ed9

7 files changed

Lines changed: 335 additions & 50 deletions

File tree

‎bsdkm/Makefile‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,14 @@ WOLFSSL_DIR=../
55

66
CFLAGS+=-I${WOLFSSL_DIR}
77
CFLAGS+=-DWOLFSSL_IGNORE_FILE_WARN -DHAVE_CONFIG_H -DNO_MAIN_DRIVER
8-
# debug printing
9-
# CFLAGS+=-DWOLFSSL_BSDKM_VERBOSE_DEBUG
8+
#
9+
# debug options
10+
# verbose printing:
11+
# CFLAGS+=-DWOLFSSL_BSDKM_VERBOSE_DEBUG
12+
#
13+
# print memory mallocs / frees:
14+
# CFLAGS+=-DWOLFSSL_BSDKM_MEMORY_DEBUG
15+
#
1016
CFLAGS+=$(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS)
1117

1218
# FreeBSD make does not support GNU make's patsubst and related. Filter

‎bsdkm/README.md‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
# wolfSSL bsdkm (bsd kernel module)
2+
3+
libwolfssl supports building as a FreeBSD kernel module (`libwolfssl.ko`).
4+
When loaded, wolfCrypt is made available to the rest of the kernel, allowing
5+
other loadable modules to link to wolfCrypt.
6+
7+
Supported features:
8+
- wolfCrypt in kernel.
9+
- FIPS-wolfcrypt.
10+
11+
Planned features:
12+
- crypto acceleration: AES-NI, AVX, etc.
13+
- kernel opencrypto driver registration.
14+
- full wolfSSL in kernel (kernel TLS).
15+
16+
## Building and Installing
17+
18+
Build bsdkm with:
19+
20+
```sh
21+
./configure --enable-freebsdkm --enable-cryptonly && make
22+
```
23+
24+
The default freebsdkm build assumes kernel source tree root at `/usr/src/sys/`.
25+
Use `--with-kernel-source=PATH` to configure a different path.
26+
27+
Assuming you are targeting your native system, install with:
28+
29+
```sh
30+
sudo kldload bsdkm/libwolfssl.ko
31+
```
32+
33+
You should see it now:
34+
```sh
35+
kldstat -m libwolfssl
36+
Id Refs Name
37+
509 1 libwolfssl
38+
```
39+
40+
Unload with:
41+
```sh
42+
sudo kldunload libwolfssl
43+
```
44+
45+
### options
46+
47+
| freebsdkm option | description |
48+
| :------------------------------- | :--------------------------------------- |
49+
| --with-bsd-export-syms=LIST | Export list of symbols as global. <br>. Options are 'all', 'none', or <br> comma separated list of symbols. |
50+
| --with-kernel-source=PATH | Path to kernel tree root (default `/usr/src/sys`) |
51+
52+
### FIPS
53+
54+
Building with FIPS is largely the same, with the additional step of
55+
configuring a fips hash.
56+
57+
1. Build bsdkm (the `fips_hash` here is a placeholder):
58+
59+
```sh
60+
fips_hash=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
61+
./configure --enable-freebsdkm --enable-cryptonly --enable-fips=v6 \
62+
CFLAGS="-DWOLFCRYPT_FIPS_CORE_HASH_VALUE=$fips_hash" && make
63+
```
64+
65+
2. Attempt first install. This is expected to fail, because the hash was a
66+
placeholder.
67+
```sh
68+
$ sudo kldload bsdkm/libwolfssl.ko
69+
kldload: an error occurred while loading module bsdkm/libwolfssl.ko. Please check dmesg(8) for more details.
70+
```
71+
72+
3. Check dmesg output for the updated hash value (yours will be different).
73+
```sh
74+
$ dmesg | tail -n5
75+
In-core integrity hash check failure.
76+
Rebuild with "WOLFCRYPT_FIPS_CORE_HASH_VALUE=3B144A08F291DBA536324646BBD127447B8F222D29A135780E330351E0DF9F0F".
77+
error: wc_RunAllCast_fips failed at shutdown with return value 19
78+
info: libwolfssl unloaded
79+
module_register_init: MOD_LOAD (libwolfssl_fips, 0xffffffff842c28d0, 0) error 85
80+
```
81+
82+
4. Repeat steps 1-2 with the new hash value. The load should succeed now.
83+
84+
```
85+
$ kldstat -m libwolfssl_fips
86+
Id Refs Name
87+
523 1 libwolfssl_fips
88+
```
89+
90+
Unload with
91+
```
92+
sudo kldunload libwolfssl
93+
```
94+
95+
On unload, the FIPS self-test will run a final time and print its status
96+
to system message buffer:
97+
98+
```
99+
info: wolfCrypt FIPS re-self-test succeeded at unload: all algorithms re-verified.
100+
info: libwolfssl unloaded
101+
```
102+

‎bsdkm/bsdkm_wc_port.h‎

Lines changed: 47 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -37,11 +37,16 @@
3737
#include <sys/limits.h>
3838
#endif /* !CHAR_BIT*/
3939

40+
#define NO_THREAD_LS
41+
#define NO_ATTRIBUTE_CONSTRUCTOR
42+
4043
/* needed to prevent wolfcrypt/src/asn.c version shadowing
4144
* extern global version from /usr/src/sys/sys/systm.h */
4245
#define version wc_version
4346

44-
#define wc_km_printf printf
47+
/* printf and logging defines */
48+
#define wc_km_printf printf
49+
#define WOLFSSL_DEBUG_PRINTF_FN printf
4550

4651
/* str and char utility functions */
4752
#define XATOI(s) ({ \
@@ -51,7 +56,7 @@
5156
_xatoi_ret = 0; \
5257
} \
5358
(int)_xatoi_ret; \
54-
})
59+
})
5560

5661
#if !defined(XMALLOC_OVERRIDE)
5762
#error bsdkm requires XMALLOC_OVERRIDE
@@ -60,21 +65,45 @@
6065
/* use malloc and free from /usr/include/sys/malloc.h */
6166
extern struct malloc_type M_WOLFSSL[1];
6267

63-
#define XMALLOC(s, h, t) \
64-
({(void)(h); (void)(t); malloc(s, M_WOLFSSL, M_WAITOK | M_ZERO);})
68+
#if defined(WOLFSSL_BSDKM_MEMORY_DEBUG)
69+
#define XMALLOC(s, h, t) ({ \
70+
(void)(h); (void)(t); \
71+
void * _ptr = malloc(s, M_WOLFSSL, M_WAITOK | M_ZERO); \
72+
printf("info: malloc: %p, M_WOLFSSL, %zu\n", _ptr, (size_t) s); \
73+
(void *)_ptr; \
74+
})
6575

66-
#ifdef WOLFSSL_XFREE_NO_NULLNESS_CHECK
67-
#define XFREE(p, h, t) \
68-
({(void)(h); (void)(t); free(p, M_WOLFSSL);})
76+
#define XFREE(p, h, t) ({ \
77+
void* _xp; (void)(h); (void)(t); _xp = (p); \
78+
printf("info: free: %p, M_WOLFSSL\n", p); \
79+
if(_xp) free(_xp, M_WOLFSSL); \
80+
})
6981
#else
70-
#define XFREE(p, h, t) \
71-
({void* _xp; (void)(h); (void)(t); _xp = (p); \
72-
if(_xp) free(_xp, M_WOLFSSL);})
73-
#endif
82+
#define XMALLOC(s, h, t) ({ \
83+
(void)(h); (void)(t); \
84+
void * _ptr = malloc(s, M_WOLFSSL, M_WAITOK | M_ZERO); \
85+
(void *)_ptr; \
86+
})
87+
88+
#define XFREE(p, h, t) ({ \
89+
void* _xp; (void)(h); (void)(t); _xp = (p); \
90+
if(_xp) free(_xp, M_WOLFSSL); \
91+
})
92+
#endif /* WOLFSSL_BSDKM_DEBUG_MEMORY */
7493

7594
#if !defined(SINGLE_THREADED)
7695
#define WC_MUTEX_OPS_INLINE
7796

97+
/* Copied from wc_port.h */
98+
#if defined(HAVE_FIPS) && !defined(WOLFSSL_API_PREFIX_MAP)
99+
/* For FIPS keep the function names the same */
100+
#define wc_InitMutex InitMutex
101+
#define wc_FreeMutex FreeMutex
102+
#define wc_LockMutex LockMutex
103+
#define wc_UnLockMutex UnLockMutex
104+
#define NO_THREAD_LS
105+
#endif /* HAVE_FIPS */
106+
78107
typedef struct wolfSSL_Mutex {
79108
struct mtx lock;
80109
} wolfSSL_Mutex;
@@ -106,12 +135,18 @@ extern struct malloc_type M_WOLFSSL[1];
106135

107136
#if defined(WOLFSSL_HAVE_ATOMIC_H) && !defined(WOLFSSL_NO_ATOMICS)
108137
#include <machine/atomic.h>
109-
typedef volatile int wolfSSL_Atomic_Int;
138+
typedef volatile int wolfSSL_Atomic_Int;
110139
typedef volatile unsigned int wolfSSL_Atomic_Uint;
111140
#define WOLFSSL_ATOMIC_INITIALIZER(x) (x)
112141
#define WOLFSSL_ATOMIC_LOAD(x) (int)atomic_load_acq_int(&(x))
113142
#define WOLFSSL_ATOMIC_STORE(x, v) atomic_store_rel_int(&(x), (v))
114143
#define WOLFSSL_ATOMIC_OPS
144+
145+
#if defined(HAVE_FIPS)
146+
/* There is no corresponding ATOMIC_INIT macro in FreeBSD.
147+
* The FreeBSD equivalent is just an integer initialization. */
148+
#define ATOMIC_INIT(x) (x)
149+
#endif
115150
#endif /* WOLFSSL_HAVE_ATOMIC_H && !WOLFSSL_NO_ATOMICS */
116151

117152
#endif /* WOLFSSL_BSDKM */

‎bsdkm/include.am‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,5 +4,6 @@
44

55
EXTRA_DIST += m4/ax_bsdkm.m4 \
66
bsdkm/Makefile \
7+
bsdkm/README.md \
78
bsdkm/wolfkmod.c \
89
bsdkm/bsdkm_wc_port.h

0 commit comments

Comments
 (0)