DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

af_alg: Crypto wrappers for Linux kernel crypto (AF_ALG)

Browse source 
CONFIG_TLS=linux can now be used to select the crypto implementation
that uses the user space socket interface (AF_ALG) for the Linux kernel
crypto implementation. This commit includes some of the cipher, hash,
and HMAC functions. The functions that are not available through AF_ALG
(e.g., the actual TLS implementation) use the internal implementation
(CONFIG_TLS=internal).

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2017-02-27 01:10:02 +02:00
parent b41d3e0a75
commit 206516e8c2
5 changed files with 1124 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

60
hostapd/Makefile
View file

@ -732,6 +732,47 @@ CONFIG_INTERNAL_RC4=y
endif endif
endif endif
ifeq ($(CONFIG_TLS), linux)
OBJS += ../src/crypto/crypto_linux.o
ifdef TLS_FUNCS
OBJS += ../src/crypto/crypto_internal-rsa.o
OBJS += ../src/crypto/tls_internal.o
OBJS += ../src/tls/tlsv1_common.o
OBJS += ../src/tls/tlsv1_record.o
OBJS += ../src/tls/tlsv1_cred.o
OBJS += ../src/tls/tlsv1_server.o
OBJS += ../src/tls/tlsv1_server_write.o
OBJS += ../src/tls/tlsv1_server_read.o
OBJS += ../src/tls/asn1.o
OBJS += ../src/tls/rsa.o
OBJS += ../src/tls/x509v3.o
OBJS += ../src/tls/pkcs1.o
OBJS += ../src/tls/pkcs5.o
OBJS += ../src/tls/pkcs8.o
NEED_SHA256=y
NEED_BASE64=y
NEED_TLS_PRF=y
ifdef CONFIG_TLSV12
NEED_TLS_PRF_SHA256=y
endif
NEED_MODEXP=y
NEED_CIPHER=y
CFLAGS += -DCONFIG_TLS_INTERNAL
CFLAGS += -DCONFIG_TLS_INTERNAL_SERVER
endif
ifdef NEED_MODEXP
OBJS += ../src/crypto/crypto_internal-modexp.o
OBJS += ../src/tls/bignum.o
CFLAGS += -DCONFIG_INTERNAL_LIBTOMMATH
CFLAGS += -DLTM_FAST
endif
CONFIG_INTERNAL_DH_GROUP5=y
ifdef NEED_FIPS186_2_PRF
OBJS += ../src/crypto/fips_prf_internal.o
OBJS += ../src/crypto/sha1-internal.o
endif
endif
ifeq ($(CONFIG_TLS), none) ifeq ($(CONFIG_TLS), none)
ifdef TLS_FUNCS ifdef TLS_FUNCS
OBJS += ../src/crypto/tls_none.o OBJS += ../src/crypto/tls_none.o
@ -781,20 +822,26 @@ ifdef NEED_AES_ENCBLOCK
AESOBJS += ../src/crypto/aes-encblock.o AESOBJS += ../src/crypto/aes-encblock.o
endif endif
ifdef NEED_AES_OMAC1 ifdef NEED_AES_OMAC1
ifneq ($(CONFIG_TLS), linux)
AESOBJS += ../src/crypto/aes-omac1.o AESOBJS += ../src/crypto/aes-omac1.o
endif endif
endif
ifdef NEED_AES_UNWRAP ifdef NEED_AES_UNWRAP
ifneq ($(CONFIG_TLS), openssl) ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), linux)
NEED_AES_DEC=y NEED_AES_DEC=y
AESOBJS += ../src/crypto/aes-unwrap.o AESOBJS += ../src/crypto/aes-unwrap.o
endif endif
endif endif
endif
ifdef NEED_AES_CBC ifdef NEED_AES_CBC
NEED_AES_DEC=y NEED_AES_DEC=y
ifneq ($(CONFIG_TLS), openssl) ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), linux)
AESOBJS += ../src/crypto/aes-cbc.o AESOBJS += ../src/crypto/aes-cbc.o
endif endif
endif endif
endif
ifdef NEED_AES_DEC ifdef NEED_AES_DEC
ifdef CONFIG_INTERNAL_AES ifdef CONFIG_INTERNAL_AES
AESOBJS += ../src/crypto/aes-internal-dec.o AESOBJS += ../src/crypto/aes-internal-dec.o
@ -806,8 +853,10 @@ endif
ifdef NEED_SHA1 ifdef NEED_SHA1
ifneq ($(CONFIG_TLS), openssl) ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), linux)
SHA1OBJS += ../src/crypto/sha1.o SHA1OBJS += ../src/crypto/sha1.o
endif endif
endif
SHA1OBJS += ../src/crypto/sha1-prf.o SHA1OBJS += ../src/crypto/sha1-prf.o
ifdef CONFIG_INTERNAL_SHA1 ifdef CONFIG_INTERNAL_SHA1
SHA1OBJS += ../src/crypto/sha1-internal.o SHA1OBJS += ../src/crypto/sha1-internal.o
@ -831,8 +880,10 @@ OBJS += $(SHA1OBJS)
endif endif
ifneq ($(CONFIG_TLS), openssl) ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), linux)
OBJS += ../src/crypto/md5.o OBJS += ../src/crypto/md5.o
endif endif
endif
ifdef NEED_MD5 ifdef NEED_MD5
ifdef CONFIG_INTERNAL_MD5 ifdef CONFIG_INTERNAL_MD5
@ -868,8 +919,10 @@ endif
ifdef NEED_SHA256 ifdef NEED_SHA256
CFLAGS += -DCONFIG_SHA256 CFLAGS += -DCONFIG_SHA256
ifneq ($(CONFIG_TLS), openssl) ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), linux)
OBJS += ../src/crypto/sha256.o OBJS += ../src/crypto/sha256.o
endif endif
endif
OBJS += ../src/crypto/sha256-prf.o OBJS += ../src/crypto/sha256-prf.o
ifdef CONFIG_INTERNAL_SHA256 ifdef CONFIG_INTERNAL_SHA256
OBJS += ../src/crypto/sha256-internal.o OBJS += ../src/crypto/sha256-internal.o
@ -884,8 +937,10 @@ endif
ifdef NEED_SHA384 ifdef NEED_SHA384
CFLAGS += -DCONFIG_SHA384 CFLAGS += -DCONFIG_SHA384
ifneq ($(CONFIG_TLS), openssl) ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), linux)
OBJS += ../src/crypto/sha384.o OBJS += ../src/crypto/sha384.o
endif endif
endif
OBJS += ../src/crypto/sha384-prf.o OBJS += ../src/crypto/sha384-prf.o
endif endif
@ -923,9 +978,11 @@ HOBJS += ../src/crypto/random.o
HOBJS += ../src/utils/eloop.o HOBJS += ../src/utils/eloop.o
HOBJS += $(SHA1OBJS) HOBJS += $(SHA1OBJS)
ifneq ($(CONFIG_TLS), openssl) ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), linux)
HOBJS += ../src/crypto/md5.o HOBJS += ../src/crypto/md5.o
endif endif
endif endif
endif
ifdef CONFIG_RADIUS_SERVER ifdef CONFIG_RADIUS_SERVER
CFLAGS += -DRADIUS_SERVER CFLAGS += -DRADIUS_SERVER
@ -1124,6 +1181,9 @@ ifdef CONFIG_INTERNAL_AES
HOBJS += ../src/crypto/aes-internal.o HOBJS += ../src/crypto/aes-internal.o
HOBJS += ../src/crypto/aes-internal-enc.o HOBJS += ../src/crypto/aes-internal-enc.o
endif endif
ifeq ($(CONFIG_TLS), linux)
HOBJS += ../src/crypto/crypto_linux.o
endif
nt_password_hash: $(NOBJS) nt_password_hash: $(NOBJS)
$(Q)$(CC) $(LDFLAGS) -o nt_password_hash $(NOBJS) $(LIBS_n) $(Q)$(CC) $(LDFLAGS) -o nt_password_hash $(NOBJS) $(LIBS_n)

1
hostapd/defconfig
View file

@ -265,6 +265,7 @@ CONFIG_IPV6=y
# openssl = OpenSSL (default) # openssl = OpenSSL (default)
# gnutls = GnuTLS # gnutls = GnuTLS
# internal = Internal TLSv1 implementation (experimental) # internal = Internal TLSv1 implementation (experimental)
# linux = Linux kernel AF_ALG and internal TLSv1 implementation (experimental)
# none = Empty template # none = Empty template
#CONFIG_TLS=openssl #CONFIG_TLS=openssl

1006
src/crypto/crypto_linux.c Normal file
View file

File diff suppressed because it is too large Load diff

56
wpa_supplicant/Makefile
View file

@ -1143,6 +1143,48 @@ CONFIG_INTERNAL_RC4=y
endif endif
endif endif
ifeq ($(CONFIG_TLS), linux)
OBJS += ../src/crypto/crypto_linux.o
OBJS_p += ../src/crypto/crypto_linux.o
ifdef TLS_FUNCS
OBJS += ../src/crypto/crypto_internal-rsa.o
OBJS += ../src/crypto/tls_internal.o
OBJS += ../src/tls/tlsv1_common.o
OBJS += ../src/tls/tlsv1_record.o
OBJS += ../src/tls/tlsv1_cred.o
OBJS += ../src/tls/tlsv1_client.o
OBJS += ../src/tls/tlsv1_client_write.o
OBJS += ../src/tls/tlsv1_client_read.o
OBJS += ../src/tls/tlsv1_client_ocsp.o
OBJS += ../src/tls/asn1.o
OBJS += ../src/tls/rsa.o
OBJS += ../src/tls/x509v3.o
OBJS += ../src/tls/pkcs1.o
OBJS += ../src/tls/pkcs5.o
OBJS += ../src/tls/pkcs8.o
NEED_SHA256=y
NEED_BASE64=y
NEED_TLS_PRF=y
ifdef CONFIG_TLSV12
NEED_TLS_PRF_SHA256=y
endif
NEED_MODEXP=y
NEED_CIPHER=y
CFLAGS += -DCONFIG_TLS_INTERNAL_CLIENT
endif
ifdef NEED_MODEXP
OBJS += ../src/crypto/crypto_internal-modexp.o
OBJS += ../src/tls/bignum.o
CFLAGS += -DCONFIG_INTERNAL_LIBTOMMATH
CFLAGS += -DLTM_FAST
endif
CONFIG_INTERNAL_DH_GROUP5=y
ifdef NEED_FIPS186_2_PRF
OBJS += ../src/crypto/fips_prf_internal.o
OBJS += ../src/crypto/sha1-internal.o
endif
endif
ifeq ($(CONFIG_TLS), none) ifeq ($(CONFIG_TLS), none)
ifdef TLS_FUNCS ifdef TLS_FUNCS
OBJS += ../src/crypto/tls_none.o OBJS += ../src/crypto/tls_none.o
@ -1197,8 +1239,10 @@ NEED_INTERNAL_AES_WRAP=y
endif endif
ifdef NEED_INTERNAL_AES_WRAP ifdef NEED_INTERNAL_AES_WRAP
ifneq ($(CONFIG_TLS), linux)
AESOBJS += ../src/crypto/aes-unwrap.o AESOBJS += ../src/crypto/aes-unwrap.o
endif endif
endif
ifdef NEED_AES_EAX ifdef NEED_AES_EAX
AESOBJS += ../src/crypto/aes-eax.o AESOBJS += ../src/crypto/aes-eax.o
NEED_AES_CTR=y NEED_AES_CTR=y
@ -1220,9 +1264,11 @@ NEED_AES_ENC=y
ifdef CONFIG_OPENSSL_CMAC ifdef CONFIG_OPENSSL_CMAC
CFLAGS += -DCONFIG_OPENSSL_CMAC CFLAGS += -DCONFIG_OPENSSL_CMAC
else else
ifneq ($(CONFIG_TLS), linux)
AESOBJS += ../src/crypto/aes-omac1.o AESOBJS += ../src/crypto/aes-omac1.o
endif endif
endif endif
endif
ifdef NEED_AES_WRAP ifdef NEED_AES_WRAP
NEED_AES_ENC=y NEED_AES_ENC=y
ifdef NEED_INTERNAL_AES_WRAP ifdef NEED_INTERNAL_AES_WRAP
@ -1232,9 +1278,11 @@ endif
ifdef NEED_AES_CBC ifdef NEED_AES_CBC
NEED_AES_ENC=y NEED_AES_ENC=y
ifneq ($(CONFIG_TLS), openssl) ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), linux)
AESOBJS += ../src/crypto/aes-cbc.o AESOBJS += ../src/crypto/aes-cbc.o
endif endif
endif endif
endif
ifdef NEED_AES_ENC ifdef NEED_AES_ENC
ifdef CONFIG_INTERNAL_AES ifdef CONFIG_INTERNAL_AES
AESOBJS += ../src/crypto/aes-internal-enc.o AESOBJS += ../src/crypto/aes-internal-enc.o
@ -1246,8 +1294,10 @@ endif
ifdef NEED_SHA1 ifdef NEED_SHA1
ifneq ($(CONFIG_TLS), openssl) ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), linux)
SHA1OBJS += ../src/crypto/sha1.o SHA1OBJS += ../src/crypto/sha1.o
endif endif
endif
SHA1OBJS += ../src/crypto/sha1-prf.o SHA1OBJS += ../src/crypto/sha1-prf.o
ifdef CONFIG_INTERNAL_SHA1 ifdef CONFIG_INTERNAL_SHA1
SHA1OBJS += ../src/crypto/sha1-internal.o SHA1OBJS += ../src/crypto/sha1-internal.o
@ -1272,9 +1322,11 @@ endif
ifndef CONFIG_FIPS ifndef CONFIG_FIPS
ifneq ($(CONFIG_TLS), openssl) ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), linux)
MD5OBJS += ../src/crypto/md5.o MD5OBJS += ../src/crypto/md5.o
endif endif
endif endif
endif
ifdef NEED_MD5 ifdef NEED_MD5
ifdef CONFIG_INTERNAL_MD5 ifdef CONFIG_INTERNAL_MD5
MD5OBJS += ../src/crypto/md5-internal.o MD5OBJS += ../src/crypto/md5-internal.o
@ -1313,8 +1365,10 @@ SHA256OBJS = # none by default
ifdef NEED_SHA256 ifdef NEED_SHA256
CFLAGS += -DCONFIG_SHA256 CFLAGS += -DCONFIG_SHA256
ifneq ($(CONFIG_TLS), openssl) ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), linux)
SHA256OBJS += ../src/crypto/sha256.o SHA256OBJS += ../src/crypto/sha256.o
endif endif
endif
SHA256OBJS += ../src/crypto/sha256-prf.o SHA256OBJS += ../src/crypto/sha256-prf.o
ifdef CONFIG_INTERNAL_SHA256 ifdef CONFIG_INTERNAL_SHA256
SHA256OBJS += ../src/crypto/sha256-internal.o SHA256OBJS += ../src/crypto/sha256-internal.o
@ -1338,8 +1392,10 @@ OBJS += $(SHA256OBJS)
endif endif
ifdef NEED_SHA384 ifdef NEED_SHA384
ifneq ($(CONFIG_TLS), openssl) ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), linux)
OBJS += ../src/crypto/sha384.o OBJS += ../src/crypto/sha384.o
endif endif
endif
CFLAGS += -DCONFIG_SHA384 CFLAGS += -DCONFIG_SHA384
OBJS += ../src/crypto/sha384-prf.o OBJS += ../src/crypto/sha384-prf.o
endif endif

1
wpa_supplicant/defconfig
View file

@ -299,6 +299,7 @@ CONFIG_PEERKEY=y
# openssl = OpenSSL (default) # openssl = OpenSSL (default)
# gnutls = GnuTLS # gnutls = GnuTLS
# internal = Internal TLSv1 implementation (experimental) # internal = Internal TLSv1 implementation (experimental)
# linux = Linux kernel AF_ALG and internal TLSv1 implementation (experimental)
# none = Empty template # none = Empty template
#CONFIG_TLS=openssl #CONFIG_TLS=openssl