BoringSSL: Allow internal AES key wrap to be used with "OpenSSL" build

It looks like BoringSSL has removed the AES_wrap_key(), AES_unwrap_key()
API. This broke wpa_supplicant/hostapd build since those functions from
OpenSSL were used to replace the internal AES key wrap implementation.
Add a new build configuration option
(CONFIG_OPENSSL_INTERNAL_AES_WRAP=y) to allow the internal
implementation to be used with CONFIG_OPENSSL=y build to allow build
against the latest BoringSSL version.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>

diff --git a/src/crypto/crypto_openssl.c b/src/crypto/crypto_openssl.c
index a82429326e5b7d279b04bd9cc71268bd73fe99d3..6cff75c64ae5a918a193d1ec777e9968d3ddcac1 100644 (file)
--- a/src/crypto/crypto_openssl.c
+++ b/src/crypto/crypto_openssl.c
@@ -304,6 +304,7 @@ void aes_decrypt_deinit(void *ctx)
 
 
 #ifndef CONFIG_FIPS
+#ifndef CONFIG_OPENSSL_INTERNAL_AES_WRAP
 
 int aes_wrap(const u8 *kek, size_t kek_len, int n, const u8 *plain, u8 *cipher)
 {
@@ -331,6 +332,7 @@ int aes_unwrap(const u8 *kek, size_t kek_len, int n, const u8 *cipher,
        return res <= 0 ? -1 : 0;
 }
 
+#endif /* CONFIG_OPENSSL_INTERNAL_AES_WRAP */
 #endif /* CONFIG_FIPS */
 
 

diff --git a/wpa_supplicant/Android.mk b/wpa_supplicant/Android.mk
index 791f857efe1287a4d29debe00fffc441d4f13a4f..3673ba77ddb34c456339ee3a448d77980bdb8b3d 100644 (file)
--- a/wpa_supplicant/Android.mk
+++ b/wpa_supplicant/Android.mk
@@ -1140,6 +1140,11 @@ endif
 ifneq ($(CONFIG_TLS), openssl)
 NEED_INTERNAL_AES_WRAP=y
 endif
+ifdef CONFIG_OPENSSL_INTERNAL_AES_WRAP
+# Seems to be needed at least with BoringSSL
+NEED_INTERNAL_AES_WRAP=y
+L_CFLAGS += -DCONFIG_OPENSSL_INTERNAL_AES_WRAP
+endif
 ifdef CONFIG_FIPS
 # Have to use internal AES key wrap routines to use OpenSSL EVP since the
 # OpenSSL AES_wrap_key()/AES_unwrap_key() API is not available in FIPS mode.

diff --git a/wpa_supplicant/Makefile b/wpa_supplicant/Makefile
index 6acbf43e6aa091af8a0a687cf123c3ca07978b80..1f1527a3a65bfd67bac161d2ff028866238e6267 100644 (file)
--- a/wpa_supplicant/Makefile
+++ b/wpa_supplicant/Makefile
@@ -1152,6 +1152,11 @@ endif
 ifneq ($(CONFIG_TLS), openssl)
 NEED_INTERNAL_AES_WRAP=y
 endif
+ifdef CONFIG_OPENSSL_INTERNAL_AES_WRAP
+# Seems to be needed at least with BoringSSL
+NEED_INTERNAL_AES_WRAP=y
+CFLAGS += -DCONFIG_OPENSSL_INTERNAL_AES_WRAP
+endif
 ifdef CONFIG_FIPS
 # Have to use internal AES key wrap routines to use OpenSSL EVP since the
 # OpenSSL AES_wrap_key()/AES_unwrap_key() API is not available in FIPS mode.