Skip to content

Commit

Permalink
upstream PR 7936 updates
Browse files Browse the repository at this point in the history
  • Loading branch information
@gojimmypi
gojimmypi committed Sep 26, 2024
1 parent 15ae4ae commit 0ca6ac9
Show file tree
Hide file tree
Showing 4 changed files with 55 additions and 25 deletions.
23 changes: 11 additions & 12 deletions wolfcrypt/src/port/Espressif/esp32_mp.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,6 @@
*
* Also, beware: "we have uint32_t == unsigned long for both Xtensa and RISC-V"
* see https://github.com/espressif/esp-idf/issues/9511#issuecomment-1207342464
* https://docs.espressif.com/projects/esp-idf/en/latest/esp32/migration-guides/release-5.x/5.0/gcc.html
*/

#ifdef HAVE_CONFIG_H
Expand Down Expand Up @@ -73,7 +72,7 @@
#define ESP_HW_RSAMAX_BIT 4096
#if defined(CONFIG_IDF_TARGET_ESP32)
/* See 24.3.2 Large Number Modular Exponentiation:
* https://www.espressif.com/sites/default/files/documentation/esp32_technical_reference_manual_en.pdf
* esp32_technical_reference_manual_en.pdf
* The RSA Accelerator supports specific operand lengths of N
* {512, 1024, 1536, 2048, 2560, 3072, 3584, 4096} bits
*
Expand All @@ -85,7 +84,7 @@
#define ESP_HW_MULTI_RSAMAX_BITS 2048
#elif defined(CONFIG_IDF_TARGET_ESP32S2)
/* See 18.3.1 Large Number Modular Exponentiation
* https://www.espressif.com/sites/default/files/documentation/esp32-s2_technical_reference_manual_en.pdf
* esp32-s2_technical_reference_manual_en.pdf
* RSA Accelerator supports operands of length N = (32 * x),
* where x in {1, 2, 3, . . . , 128}. The bit lengths of arguments
* Z, X, Y , M, and r can be arbitrary N, but all numbers in a calculation
Expand All @@ -94,7 +93,7 @@
#define ESP_HW_MULTI_RSAMAX_BITS 2048
#elif defined(CONFIG_IDF_TARGET_ESP32S3)
/* See 20.3.1 Large Number Modular Exponentiation
* https://www.espressif.com/sites/default/files/documentation/esp32-s3_technical_reference_manual_en.pdf
* esp32-s3_technical_reference_manual_en.pdf
* RSA Accelerator supports operands of length N = (32 * x),
* where x in {1, 2, 3, . . . , 128}. The bit lengths of arguments
* Z, X, Y , M, and r can be arbitrary N, but all numbers in a calculation
Expand All @@ -103,7 +102,7 @@
#define ESP_HW_MULTI_RSAMAX_BITS 2048
#elif defined(CONFIG_IDF_TARGET_ESP32C3)
/* See 20.3.1 Large Number Modular Exponentiation
* https://www.espressif.com/sites/default/files/documentation/esp32-c3_technical_reference_manual_en.pdf
* esp32-c3_technical_reference_manual_en.pdf
* RSA Accelerator supports operands of length N = (32 * x),
* where x in {1, 2, 3, . . . , 96}. The bit lengths of arguments
* Z, X, Y , M, and r can be arbitrary N, but all numbers in a calculation
Expand All @@ -116,7 +115,7 @@
#define ESP_HW_MULTI_RSAMAX_BITS 1536
#elif defined(CONFIG_IDF_TARGET_ESP32C6)
/* See 22.3.1 Large-number Modular Exponentiation
* https://www.espressif.com/sites/default/files/documentation/esp32-c6_technical_reference_manual_en.pdf
* esp32-c6_technical_reference_manual_en.pdf
* The RSA accelerator supports operands of length N = (32 * x),
* where x in {1, 2, 3, . . . , 96}. The bit lengths of arguments
* Z, X, Y , M, and r can be arbitrary N, but all numbers in a calculation
Expand Down Expand Up @@ -266,7 +265,7 @@ static portMUX_TYPE wc_rsa_reg_lock = portMUX_INITIALIZER_UNLOCKED;
* check if the HW is ready before accessing it
*
* See 24.3.1 Initialization of ESP32 Technical Reference Manual
* https://www.espressif.com/sites/default/files/documentation/esp32_technical_reference_manual_en.pdf
* esp32_technical_reference_manual_en.pdf
*
* The RSA Accelerator is activated by enabling the corresponding peripheral
* clock, and by clearing the DPORT_RSA_PD bit in the DPORT_RSA_PD_CTRL_REG
Expand Down Expand Up @@ -320,7 +319,7 @@ static int esp_mp_hw_wait_clean(void)
#endif

#if defined(WOLFSSL_HW_METRICS)
/* The wait timeout in separate from the overall max calc timeout. */
/* The wait timeout is separate from the overall max calc timeout. */
if (timeout > esp_mp_max_wait_timeout) {
esp_mp_max_wait_timeout = timeout;
}
Expand All @@ -334,7 +333,7 @@ static int esp_mp_hw_wait_clean(void)
/* This is highly unusual and will likely only occur in multi-threaded
* application. wolfSSL ctx is not thread safe. */
#ifndef SINGLE_THREADED
ESP_LOG(TAG, "Consider #define SINGLE_THREADED. See docs");
ESP_LOGI(TAG, "Consider #define SINGLE_THREADED. See docs");
#endif
ESP_LOGE(TAG, "esp_mp_hw_wait_clean waiting HW ready timed out.");
ret = WC_HW_WAIT_E; /* hardware is busy, MP_HW_BUSY; */
Expand Down Expand Up @@ -383,7 +382,7 @@ static int esp_mp_hw_islocked(void)
* Returns 0 (ESP_OK) if the HW lock was initialized and mutex lock.
*
* See Chapter 24:
* https://www.espressif.com/sites/default/files/documentation/esp32_technical_reference_manual_en.pdf
* esp32_technical_reference_manual_en.pdf
*
* The RSA Accelerator is activated by enabling the corresponding peripheral
* clock, and by clearing the DPORT_RSA_PD bit in the DPORT_RSA_PD_CTRL_REG
Expand Down Expand Up @@ -2666,8 +2665,8 @@ int esp_mp_mulmod(MATH_INT_T* X, MATH_INT_T* Y, MATH_INT_T* M, MATH_INT_T* Z)
*
* Z = X^Y mod M
*
* ESP32, Section 24.3.2 https://www.espressif.com/sites/default/files/documentation/esp32_technical_reference_manual_en.pdf
* ESP32S3, Section 20.3.1, https://www.espressif.com/sites/default/files/documentation/esp32-s3_technical_reference_manual_en.pdf
* ESP32, Section 24.3.2 esp32_technical_reference_manual_en.pdf
* ESP32S3, Section 20.3.1, esp32-s3_technical_reference_manual_en.pdf
*
* The operation is based on Montgomery multiplication. Aside from the
* arguments X, Y , and M, two additional ones are needed -r and M'
Expand Down
2 changes: 1 addition & 1 deletion wolfcrypt/src/port/Espressif/esp_crt_bundle/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -110,7 +110,7 @@ attempting to simply change `www.howsmyssl.com` to `www.google.com`.
### postman

Beware there's a hard-coded PEM certificate for the [postman root cert](https://github.com/espressif/esp-idf/blob/c9df77efbf871d4c3ae9fb828778ff8c4ab36804/examples/protocols/esp_http_client/main/esp_http_client_example.c#L48)
(not in the bundle). If you see a failure, the data may ned to be updated.
(not in the bundle). If you see a failure, the data may need to be updated.

See the comments for adding certificate data, copied here for reference:

Expand Down
50 changes: 40 additions & 10 deletions wolfcrypt/src/port/Espressif/esp_crt_bundle/esp_crt_bundle.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -668,7 +668,13 @@ static CB_INLINE int wolfssl_ssl_conf_verify_cb_no_signer(int preverify,
if (ret == WOLFSSL_SUCCESS) {
_cert_bundle_loaded = 1;
start = 0;
end = s_crt_bundle.num_certs - 1;
if (s_crt_bundle.num_certs > 0) {
end = s_crt_bundle.num_certs - 1;
}
else {
ESP_LOGCBW(TAG, "The certificate bundle is empty.");
end = -1;
}

#ifndef CERT_BUNDLE_UNSORTED
/* When sorted (not unsorted), binary search: */
Expand Down Expand Up @@ -1013,6 +1019,12 @@ static CB_INLINE int wolfssl_ssl_conf_verify_cb(int preverify,

int initial_preverify;
initial_preverify = preverify;

if (store == NULL) {
ESP_LOGCBW(TAG, "wolfssl_ssl_conf_verify_cb store is Null. Abort");
return initial_preverify;
}

/* Show the interesting preverify & error state upon entry to callback. */
if (preverify == 1) {
ESP_LOGCBI(TAG, "preverify == 1\n");
Expand All @@ -1028,16 +1040,25 @@ static CB_INLINE int wolfssl_ssl_conf_verify_cb(int preverify,
ESP_LOGCBW(TAG, "store->error: %d", store->error);
}


notBefore = wolfSSL_X509_get_notBefore(store->current_cert);
wolfSSL_ASN1_TIME_to_string(notBefore, before_str, sizeof(before_str));
ESP_LOGCBI(TAG, "Not Before: %s", before_str);
if (wolfSSL_ASN1_TIME_to_string(notBefore, before_str,
sizeof(before_str)) == NULL) {
ESP_LOGCBW(TAG, "Not Before value not valid");
}
else {
ESP_LOGCBI(TAG, "Not Before: %s", before_str);
}

esp_show_current_datetime();

notAfter = wolfSSL_X509_get_notAfter(store->current_cert);
wolfSSL_ASN1_TIME_to_string(notAfter, after_str, sizeof(after_str));
ESP_LOGCBI(TAG, "Not After: %s", after_str);
if (wolfSSL_ASN1_TIME_to_string(notAfter, after_str,
sizeof(after_str)) == NULL) {
ESP_LOGCBW(TAG, "Not After value not valid");
}
else {
ESP_LOGCBI(TAG, "Not After: %s", after_str);
}
#endif

/* One possible condition is the error "Failed to find signer".
Expand Down Expand Up @@ -1144,9 +1165,14 @@ int esp_crt_verify_callback(void *buf, WOLFSSL_X509 *crt, int depth,

crt_found = false;
start = 0;
end = s_crt_bundle.num_certs - 1;
middle = (end - start) / 2;

if (s_crt_bundle.num_certs > 0) {
end = s_crt_bundle.num_certs - 1;
middle = (end - start) / 2;
}
else {
end = -1;
middle = -1;
}
/* Look for the certificate using binary search on subject name */
while (start <= end) {
name_len = (s_crt_bundle.crts[middle][0] << 8) |
Expand Down Expand Up @@ -1175,6 +1201,8 @@ int esp_crt_verify_callback(void *buf, WOLFSSL_X509 *crt, int depth,
/* This is the wolfssl_ssl_conf_verify callback to attach bundle.
* We'll verify at certificate attachment time. */
ESP_LOGV(TAG, "Found key. Len = %d", key_len);
/* Optional validation not implemented at this time. */
/* See wolfssl_ssl_conf_verify_cb() */
}
else {
ESP_LOGW(TAG, "crt not found!");
Expand All @@ -1186,6 +1214,8 @@ int esp_crt_verify_callback(void *buf, WOLFSSL_X509 *crt, int depth,
return 0;
}

ESP_LOGW(TAG, "Deprecated; this API for compiler compatibility only.");
ESP_LOGW(TAG, "Please use wolfssl_ssl_conf_verify_cb() .");
ESP_LOGE(TAG, "Failed to verify certificate");
return -1; /* WOLFSSL_ERR_X509_FATAL_ERROR; */
} /* esp_crt_verify_callback */
Expand Down Expand Up @@ -1281,7 +1311,7 @@ static esp_err_t wolfssl_esp_crt_bundle_init(const uint8_t *x509_bundle,

if (ret == ESP_OK) {
#ifdef DEBUG_WOLFSSL_MALLOC
ESP_LOGW(TAG, "calloc certs: %d bytes", sizeof(x509_bundle));
ESP_LOGW(TAG, "calloc certs: %d bytes", (uint)sizeof(x509_bundle));
#endif
/* Contiguous allocation is important to our cert extraction. */
crts = calloc(num_certs, sizeof(x509_bundle));
Expand Down
5 changes: 3 additions & 2 deletions wolfcrypt/src/port/Espressif/esp_sdk_time_lib.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -119,7 +119,8 @@ esp_err_t esp_sdk_time_lib_init(void)
#define CONFIG_LWIP_SNTP_MAX_SERVERS NTP_SERVER_COUNT
#endif

/* When reproducible builds are enabled in ESP-IDF (starting from version 4.0 and above),
/* When reproducible builds are enabled in ESP-IDF
* (starting from version 4.0 and above),
* the __DATE__ and __TIME__ macros are deliberately disabled. */
#ifndef __DATE__
#define YEAR 2024
Expand All @@ -145,7 +146,7 @@ esp_err_t esp_sdk_time_lib_init(void)
: __DATE__[2] == 't' ? 10 \
: __DATE__[2] == 'v' ? 11 \
: 12 \
)
)

#define DAY ( \
((__DATE__)[4] - '0') * 10 + \
Expand Down

0 comments on commit 0ca6ac9

Please sign in to comment.