Skip to content

Commit e4996c3

Browse files
philljjphilljj
committed
bsdkm: fips support.
1 parent e70e7cb commit e4996c3

8 files changed

Lines changed: 332 additions & 48 deletions

File tree

‎bsdkm/Makefile‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,14 @@ WOLFSSL_DIR=../
55

66
CFLAGS+=-I${WOLFSSL_DIR}
77
CFLAGS+=-DWOLFSSL_IGNORE_FILE_WARN -DHAVE_CONFIG_H -DNO_MAIN_DRIVER
8-
# debug printing
9-
# CFLAGS+=-DWOLFSSL_BSDKM_VERBOSE_DEBUG
8+
#
9+
# debug options
10+
# verbose printing:
11+
# CFLAGS+=-DWOLFSSL_BSDKM_VERBOSE_DEBUG
12+
#
13+
# print memory mallocs / frees:
14+
# CFLAGS+=-DWOLFSSL_BSDKM_MEMORY_DEBUG
15+
#
1016
CFLAGS+=$(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS)
1117

1218
# FreeBSD make does not support GNU make's patsubst and related. Filter

‎bsdkm/README.md‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
# wolfSSL bsdkm (bsd kernel module)
2+
3+
libwolfssl supports building as a FreeBSD kernel module (`libwolfssl.ko`).
4+
When loaded, wolfCrypt is made available to the rest of the kernel, allowing
5+
other loadable modules to link to wolfCrypt.
6+
7+
Supported features:
8+
- wolfCrypt in kernel.
9+
- FIPS-wolfcrypt.
10+
11+
Planned features:
12+
- crypto acceleration: AES-NI, AVX, etc.
13+
- kernel opencrypto driver registration.
14+
- full wolfSSL in kernel (kernel TLS).
15+
16+
## Building and Installing
17+
18+
Build bsdkm with:
19+
20+
```sh
21+
./configure --enable-freebsdkm --enable-cryptonly && make
22+
```
23+
24+
The default freebsdkm build assumes kernel source tree root at `/usr/src/sys/`.
25+
Use `--with-kernel-source=PATH` to configure a different path.
26+
27+
Assuming you are targeting your native system, install with:
28+
29+
```sh
30+
sudo kldload bsdkm/libwolfssl.ko
31+
```
32+
33+
You should see it now:
34+
```sh
35+
kldstat -m libwolfssl
36+
Id Refs Name
37+
509 1 libwolfssl
38+
```
39+
40+
Unload with:
41+
```sh
42+
sudo kldunload libwolfssl
43+
```
44+
45+
### options
46+
47+
| freebsdkm option | description |
48+
| :------------------------------- | :--------------------------------------- |
49+
| --with-bsd-export-syms=LIST | Export list of symbols as global. <br>. Options are 'all', 'none', or <br> comma separated list of symbols. |
50+
| --with-kernel-source=PATH | Path to kernel tree root (default `/usr/src/sys`) |
51+
52+
### FIPS
53+
54+
Building with FIPS is largely the same, with the additional step of
55+
configuring a fips hash.
56+
57+
1. Build bsdkm (the `fips_hash` here is a placeholder):
58+
59+
```sh
60+
fips_hash=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
61+
./configure --enable-freebsdkm --enable-cryptonly --enable-fips=v6 \
62+
CFLAGS="-DWOLFCRYPT_FIPS_CORE_HASH_VALUE=$fips_hash" && make
63+
```
64+
65+
2. Attempt first install. This is expected to fail, because the hash was a
66+
placeholder.
67+
```sh
68+
$ sudo kldload bsdkm/libwolfssl.ko
69+
Password:
70+
kldload: an error occurred while loading module bsdkm/libwolfssl.ko. Please check dmesg(8) for more details.
71+
```
72+
73+
3. Check dmesg output for the updated hash value (yours will be different).
74+
```sh
75+
$ dmesg | tail -n5
76+
In-core integrity hash check failure.
77+
Rebuild with "WOLFCRYPT_FIPS_CORE_HASH_VALUE=3B144A08F291DBA536324646BBD127447B8F222D29A135780E330351E0DF9F0F".
78+
error: wc_RunAllCast_fips failed at shutdown with return value 19
79+
info: libwolfssl unloaded
80+
module_register_init: MOD_LOAD (libwolfssl_fips, 0xffffffff842c28d0, 0) error 85
81+
```
82+
83+
4. Repeat steps 1-2 with the new hash value. The load should succeed now.
84+
85+
```
86+
$ kldstat -m libwolfssl_fips
87+
Id Refs Name
88+
523 1 libwolfssl_fips
89+
```
90+
91+
On unload, the FIPS self-test will run a final time and print its status
92+
to system message buffer:
93+
94+
```
95+
info: wolfCrypt FIPS re-self-test succeeded at unload: all algorithms re-verified.
96+
info: libwolfssl unloaded
97+
```
98+

‎bsdkm/bsdkm_wc_port.h‎

Lines changed: 46 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -37,11 +37,15 @@
3737
#include <sys/limits.h>
3838
#endif /* !CHAR_BIT*/
3939

40+
#define NO_THREAD_LS
41+
#define NO_ATTRIBUTE_CONSTRUCTOR
42+
4043
/* needed to prevent wolfcrypt/src/asn.c version shadowing
4144
* extern global version from /usr/src/sys/sys/systm.h */
4245
#define version wc_version
4346

44-
#define wc_km_printf printf
47+
#define wc_km_printf printf
48+
#define wc_km_print_err printf
4549

4650
/* str and char utility functions */
4751
#define XATOI(s) ({ \
@@ -51,7 +55,7 @@
5155
_xatoi_ret = 0; \
5256
} \
5357
(int)_xatoi_ret; \
54-
})
58+
})
5559

5660
#if !defined(XMALLOC_OVERRIDE)
5761
#error bsdkm requires XMALLOC_OVERRIDE
@@ -60,21 +64,45 @@
6064
/* use malloc and free from /usr/include/sys/malloc.h */
6165
extern struct malloc_type M_WOLFSSL[1];
6266

63-
#define XMALLOC(s, h, t) \
64-
({(void)(h); (void)(t); malloc(s, M_WOLFSSL, M_WAITOK | M_ZERO);})
67+
#if defined(WOLFSSL_BSDKM_MEMORY_DEBUG)
68+
#define XMALLOC(s, h, t) ({ \
69+
(void)(h); (void)(t); \
70+
void * _ptr = malloc(s, M_WOLFSSL, M_WAITOK | M_ZERO); \
71+
printf("info: malloc: %p, M_WOLFSSL, %zu\n", _ptr, (size_t) s); \
72+
(void *)_ptr; \
73+
})
6574

66-
#ifdef WOLFSSL_XFREE_NO_NULLNESS_CHECK
67-
#define XFREE(p, h, t) \
68-
({(void)(h); (void)(t); free(p, M_WOLFSSL);})
75+
#define XFREE(p, h, t) ({ \
76+
void* _xp; (void)(h); (void)(t); _xp = (p); \
77+
printf("info: free: %p, M_WOLFSSL\n", p); \
78+
if(_xp) free(_xp, M_WOLFSSL); \
79+
})
6980
#else
70-
#define XFREE(p, h, t) \
71-
({void* _xp; (void)(h); (void)(t); _xp = (p); \
72-
if(_xp) free(_xp, M_WOLFSSL);})
73-
#endif
81+
#define XMALLOC(s, h, t) ({ \
82+
(void)(h); (void)(t); \
83+
void * _ptr = malloc(s, M_WOLFSSL, M_WAITOK | M_ZERO); \
84+
(void *)_ptr; \
85+
})
86+
87+
#define XFREE(p, h, t) ({ \
88+
void* _xp; (void)(h); (void)(t); _xp = (p); \
89+
if(_xp) free(_xp, M_WOLFSSL); \
90+
})
91+
#endif /* WOLFSSL_BSDKM_DEBUG_MEMORY */
7492

7593
#if !defined(SINGLE_THREADED)
7694
#define WC_MUTEX_OPS_INLINE
7795

96+
/* Copied from wc_port.h */
97+
#if defined(HAVE_FIPS) && !defined(WOLFSSL_API_PREFIX_MAP)
98+
/* For FIPS keep the function names the same */
99+
#define wc_InitMutex InitMutex
100+
#define wc_FreeMutex FreeMutex
101+
#define wc_LockMutex LockMutex
102+
#define wc_UnLockMutex UnLockMutex
103+
#define NO_THREAD_LS
104+
#endif /* HAVE_FIPS */
105+
78106
typedef struct wolfSSL_Mutex {
79107
struct mtx lock;
80108
} wolfSSL_Mutex;
@@ -106,12 +134,18 @@ extern struct malloc_type M_WOLFSSL[1];
106134

107135
#if defined(WOLFSSL_HAVE_ATOMIC_H) && !defined(WOLFSSL_NO_ATOMICS)
108136
#include <machine/atomic.h>
109-
typedef volatile int wolfSSL_Atomic_Int;
137+
typedef volatile int wolfSSL_Atomic_Int;
110138
typedef volatile unsigned int wolfSSL_Atomic_Uint;
111139
#define WOLFSSL_ATOMIC_INITIALIZER(x) (x)
112140
#define WOLFSSL_ATOMIC_LOAD(x) (int)atomic_load_acq_int(&(x))
113141
#define WOLFSSL_ATOMIC_STORE(x, v) atomic_store_rel_int(&(x), (v))
114142
#define WOLFSSL_ATOMIC_OPS
143+
144+
#if defined(HAVE_FIPS)
145+
/* There is no corresponding ATOMIC_INIT macro in FreeBSD.
146+
* The FreeBSD equivalent is just an integer initialization. */
147+
#define ATOMIC_INIT(x) (x)
148+
#endif
115149
#endif /* WOLFSSL_HAVE_ATOMIC_H && !WOLFSSL_NO_ATOMICS */
116150

117151
#endif /* WOLFSSL_BSDKM */

‎bsdkm/include.am‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,5 +4,6 @@
44

55
EXTRA_DIST += m4/ax_bsdkm.m4 \
66
bsdkm/Makefile \
7+
bsdkm/README.md \
78
bsdkm/wolfkmod.c \
89
bsdkm/bsdkm_wc_port.h

0 commit comments

Comments
 (0)