wolfssl: Updates to resolve build conflicts

The wolfSSL's OpenSSL compatibility layer is not used by the plugin at
all and preventing its inclusion avoids conflicts with ASN1_ constants.

The inclusion of wolfssl/ssl.h is moved to the only file that requires
it as older wolfSSL versions defined a conflicting ASN1_GENERALIZEDTIME.

Other changes address issues with the FIPS use case.

Closes strongswan/strongswan#1332

diff --git a/src/libstrongswan/plugins/wolfssl/wolfssl_common.h b/src/libstrongswan/plugins/wolfssl/wolfssl_common.h
index cdefff4c654d287cfa96cfc5beb3f4b2e42e2ac9..9c944e71195f3d0b95ccf045ee618f6a7e5ded10 100644 (file)
--- a/src/libstrongswan/plugins/wolfssl/wolfssl_common.h
+++ b/src/libstrongswan/plugins/wolfssl/wolfssl_common.h
@@ -47,20 +47,18 @@
 /* PARSE_ERROR is an enum entry in wolfSSL - not used in this plugin */
 #define PARSE_ERROR    WOLFSSL_PARSE_ERROR
 
-/* Remap unused enums from the OpenSSL compatibility layer to avoid conflicts */
-#define ASN1_BOOLEAN         REMAP_ASN1_BOOLEAN
-#define ASN1_OID             REMAP_ASN1_OID
-#define ASN1_INTEGER         REMAP_ASN1_INTEGER
-#define ASN1_BIT_STRING      REMAP_ASN1_BIT_STRING
-#define ASN1_IA5STRING       REMAP_ASN1_IA5STRING
-#define ASN1_OCTET_STRING    REMAP_ASN1_OCTET_STRING
-#define ASN1_UTCTIME         REMAP_ASN1_UTCTIME
-#define ASN1_GENERALIZEDTIME REMAP_ASN1_GENERALIZEDTIME
-
 #ifndef WOLFSSL_USER_SETTINGS
        #include <wolfssl/options.h>
 #endif
-#include <wolfssl/ssl.h>
+
+/* Disable inclusion of the wolfSSL OpenSSL compatibility layer header (if
+ * configured) as it is not used by the plugin and causes conflicts */
+#define WOLFSSL_OPENSSL_H_
+
+#if  defined(HAVE_FIPS) && \
+    (defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2))
+    #include <wolfssl/wolfcrypt/fips_test.h>
+#endif
 
 /* Special type used to handle EdDSA keys depending on config options */
 #if defined(HAVE_ED25519) || defined(HAVE_ED448)
@@ -82,15 +80,6 @@ typedef union {
 
 #undef PARSE_ERROR
 
-#undef ASN1_BOOLEAN
-#undef ASN1_OID
-#undef ASN1_INTEGER
-#undef ASN1_BIT_STRING
-#undef ASN1_IA5STRING
-#undef ASN1_OCTET_STRING
-#undef ASN1_UTCTIME
-#undef ASN1_GENERALIZEDTIME
-
 /* Eliminate macro conflicts */
 #undef RNG
 

diff --git a/src/libstrongswan/plugins/wolfssl/wolfssl_ec_diffie_hellman.c b/src/libstrongswan/plugins/wolfssl/wolfssl_ec_diffie_hellman.c
index 4ee286f7121e585f3b1f9f86b5db4a4c9f6b164a..6d7ed570dd4d6d407b85b6efa3530958284aa3bf 100644 (file)
--- a/src/libstrongswan/plugins/wolfssl/wolfssl_ec_diffie_hellman.c
+++ b/src/libstrongswan/plugins/wolfssl/wolfssl_ec_diffie_hellman.c
@@ -31,6 +31,12 @@
 
 #include <utils/debug.h>
 
+#if defined(ECC_TIMING_RESISTANT) && \
+    (!defined(HAVE_FIPS) || \
+     (defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 5)))
+    #define USE_RNG_FOR_TIMING_RESISTANCE
+#endif
+
 typedef struct private_wolfssl_ec_diffie_hellman_t private_wolfssl_ec_diffie_hellman_t;
 
 /**
@@ -203,13 +209,14 @@ METHOD(key_exchange_t, set_private_key, bool,
 static bool compute_shared_key(private_wolfssl_ec_diffie_hellman_t *this)
 {
        word32 len;
-#ifdef ECC_TIMING_RESISTANT
+#ifdef USE_RNG_FOR_TIMING_RESISTANCE
        WC_RNG rng;
 
        if (wc_InitRng(&rng) != 0)
        {
                return FALSE;
        }
+
        if (wc_ecc_set_rng(&this->key, &rng) != 0)
        {
                wc_FreeRng(&rng);
@@ -225,13 +232,13 @@ static bool compute_shared_key(private_wolfssl_ec_diffie_hellman_t *this)
        {
                DBG1(DBG_LIB, "ECDH shared secret computation failed");
                chunk_clear(&this->shared_secret);
-#ifdef ECC_TIMING_RESISTANT
+#ifdef USE_RNG_FOR_TIMING_RESISTANCE
                wc_FreeRng(&rng);
 #endif
                return FALSE;
        }
        this->shared_secret.len = len;
-#ifdef ECC_TIMING_RESISTANT
+#ifdef USE_RNG_FOR_TIMING_RESISTANCE
        wc_FreeRng(&rng);
 #endif
        return TRUE;

diff --git a/src/libstrongswan/plugins/wolfssl/wolfssl_plugin.c b/src/libstrongswan/plugins/wolfssl/wolfssl_plugin.c
index b53bd8b09b50d15417585f831476f660210b318d..d4b4989b09794998ccc415a5382d7bae15f3b759 100644 (file)
--- a/src/libstrongswan/plugins/wolfssl/wolfssl_plugin.c
+++ b/src/libstrongswan/plugins/wolfssl/wolfssl_plugin.c
@@ -21,10 +21,11 @@
  * THE SOFTWARE.
  */
 
+#include "wolfssl_common.h"
+
 #include <library.h>
 #include <utils/debug.h>
 
-#include "wolfssl_common.h"
 #include "wolfssl_plugin.h"
 #include "wolfssl_aead.h"
 #include "wolfssl_crypter.h"
@@ -44,6 +45,8 @@
 #include "wolfssl_x_diffie_hellman.h"
 #include "wolfssl_xof.h"
 
+#include <wolfssl/ssl.h>
+
 #ifndef FIPS_MODE
 #define FIPS_MODE 0
 #endif