module_hooks.c 23 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702
  1. /* module_hooks.c -- module load/unload hooks for libwolfssl.ko
  2. *
  3. * Copyright (C) 2006-2022 wolfSSL Inc.
  4. *
  5. * This file is part of wolfSSL.
  6. *
  7. * wolfSSL is free software; you can redistribute it and/or modify
  8. * it under the terms of the GNU General Public License as published by
  9. * the Free Software Foundation; either version 2 of the License, or
  10. * (at your option) any later version.
  11. *
  12. * wolfSSL is distributed in the hope that it will be useful,
  13. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  15. * GNU General Public License for more details.
  16. *
  17. * You should have received a copy of the GNU General Public License
  18. * along with this program; if not, write to the Free Software
  19. * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
  20. */
  21. #ifndef WOLFSSL_LICENSE
  22. #define WOLFSSL_LICENSE "GPL v2"
  23. #endif
  24. #define FIPS_NO_WRAPPERS
  25. #define WOLFSSL_NEED_LINUX_CURRENT
  26. #ifdef HAVE_CONFIG_H
  27. #include <config.h>
  28. #endif
  29. #include <wolfssl/wolfcrypt/settings.h>
  30. #include <wolfssl/wolfcrypt/error-crypt.h>
  31. #ifdef WOLFCRYPT_ONLY
  32. #include <wolfssl/version.h>
  33. #else
  34. #include <wolfssl/ssl.h>
  35. #endif
  36. #ifdef HAVE_FIPS
  37. #include <wolfssl/wolfcrypt/fips_test.h>
  38. #endif
  39. #ifndef NO_CRYPT_TEST
  40. #include <wolfcrypt/test/test.h>
  41. #include <linux/delay.h>
  42. #endif
  43. static int libwolfssl_cleanup(void) {
  44. int ret;
  45. #ifdef WOLFCRYPT_ONLY
  46. ret = wolfCrypt_Cleanup();
  47. if (ret != 0)
  48. pr_err("wolfCrypt_Cleanup() failed: %s\n", wc_GetErrorString(ret));
  49. else
  50. pr_info("wolfCrypt " LIBWOLFSSL_VERSION_STRING " cleanup complete.\n");
  51. #else
  52. ret = wolfSSL_Cleanup();
  53. if (ret != WOLFSSL_SUCCESS)
  54. pr_err("wolfSSL_Cleanup() failed: %s\n", wc_GetErrorString(ret));
  55. else
  56. pr_info("wolfSSL " LIBWOLFSSL_VERSION_STRING " cleanup complete.\n");
  57. #endif
  58. return ret;
  59. }
  60. #ifdef HAVE_LINUXKM_PIE_SUPPORT
  61. extern int wolfCrypt_PIE_first_function(void);
  62. extern int wolfCrypt_PIE_last_function(void);
  63. extern const unsigned int wolfCrypt_PIE_rodata_start[];
  64. extern const unsigned int wolfCrypt_PIE_rodata_end[];
  65. /* cheap portable ad-hoc hash function to confirm bitwise stability of the PIE
  66. * binary image.
  67. */
  68. static unsigned int hash_span(char *start, char *end) {
  69. unsigned int sum = 1;
  70. while (start < end) {
  71. unsigned int rotate_by;
  72. sum ^= *start++;
  73. rotate_by = (sum ^ (sum >> 5)) & 31;
  74. sum = (sum << rotate_by) | (sum >> (32 - rotate_by));
  75. }
  76. return sum;
  77. }
  78. #ifdef USE_WOLFSSL_LINUXKM_PIE_REDIRECT_TABLE
  79. extern struct wolfssl_linuxkm_pie_redirect_table wolfssl_linuxkm_pie_redirect_table;
  80. static int set_up_wolfssl_linuxkm_pie_redirect_table(void);
  81. #endif /* USE_WOLFSSL_LINUXKM_PIE_REDIRECT_TABLE */
  82. #endif /* HAVE_LINUXKM_PIE_SUPPORT */
  83. #ifdef HAVE_FIPS
  84. static void lkmFipsCb(int ok, int err, const char* hash)
  85. {
  86. if ((! ok) || (err != 0))
  87. pr_err("libwolfssl FIPS error: %s\n", wc_GetErrorString(err));
  88. if (err == IN_CORE_FIPS_E) {
  89. pr_err("In-core integrity hash check failure.\n"
  90. "Update verifyCore[] in fips_test.c with new hash \"%s\" and rebuild.\n",
  91. hash ? hash : "<null>");
  92. }
  93. }
  94. #endif
  95. #ifdef WOLFCRYPT_FIPS_CORE_DYNAMIC_HASH_VALUE
  96. #ifndef CONFIG_MODULE_SIG
  97. #error WOLFCRYPT_FIPS_CORE_DYNAMIC_HASH_VALUE requires a CONFIG_MODULE_SIG kernel.
  98. #endif
  99. static int updateFipsHash(void);
  100. #endif
  101. #if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 0, 0)
  102. static int __init wolfssl_init(void)
  103. #else
  104. static int wolfssl_init(void)
  105. #endif
  106. {
  107. int ret;
  108. #ifdef WOLFCRYPT_FIPS_CORE_DYNAMIC_HASH_VALUE
  109. if (THIS_MODULE->sig_ok == false) {
  110. pr_err("wolfSSL module load aborted -- bad or missing module signature with FIPS dynamic hash.\n");
  111. return -ECANCELED;
  112. }
  113. ret = updateFipsHash();
  114. if (ret < 0) {
  115. pr_err("wolfSSL module load aborted -- updateFipsHash: %s\n",wc_GetErrorString(ret));
  116. return -ECANCELED;
  117. }
  118. #endif
  119. #ifdef USE_WOLFSSL_LINUXKM_PIE_REDIRECT_TABLE
  120. ret = set_up_wolfssl_linuxkm_pie_redirect_table();
  121. if (ret < 0)
  122. return ret;
  123. #endif
  124. #ifdef HAVE_LINUXKM_PIE_SUPPORT
  125. #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0)
  126. #define THIS_MODULE_BASE (THIS_MODULE->core_layout.base)
  127. #define THIS_MODULE_TEXT_SIZE (THIS_MODULE->core_layout.text_size)
  128. #define THIS_MODULE_RO_SIZE (THIS_MODULE->core_layout.ro_size)
  129. #else
  130. #define THIS_MODULE_BASE (THIS_MODULE->module_core)
  131. #define THIS_MODULE_TEXT_SIZE (THIS_MODULE->core_text_size)
  132. #define THIS_MODULE_RO_SIZE (THIS_MODULE->core_ro_size)
  133. #endif
  134. {
  135. char *pie_text_start = (char *)wolfCrypt_PIE_first_function;
  136. char *pie_text_end = (char *)wolfCrypt_PIE_last_function;
  137. char *pie_rodata_start = (char *)wolfCrypt_PIE_rodata_start;
  138. char *pie_rodata_end = (char *)wolfCrypt_PIE_rodata_end;
  139. unsigned int text_hash, rodata_hash;
  140. if ((pie_text_start < pie_text_end) &&
  141. (pie_text_start >= (char *)THIS_MODULE_BASE) &&
  142. (pie_text_end - (char *)THIS_MODULE_BASE <= THIS_MODULE_TEXT_SIZE))
  143. {
  144. text_hash = hash_span(pie_text_start, pie_text_end);
  145. } else {
  146. pr_info("out-of-bounds PIE fenceposts! pie_text_start=%px pie_text_end=%px (span=%lu)"
  147. " core_layout.base=%px text_end=%px\n",
  148. pie_text_start,
  149. pie_text_end,
  150. pie_text_end-pie_text_start,
  151. THIS_MODULE_BASE,
  152. (char *)THIS_MODULE_BASE + THIS_MODULE_TEXT_SIZE);
  153. text_hash = 0;
  154. }
  155. if ((pie_rodata_start < pie_rodata_end) && // cppcheck-suppress comparePointers
  156. (pie_rodata_start >= (char *)THIS_MODULE_BASE + THIS_MODULE_TEXT_SIZE) &&
  157. (pie_rodata_end - (char *)THIS_MODULE_BASE <= THIS_MODULE_RO_SIZE))
  158. {
  159. rodata_hash = hash_span(pie_rodata_start, pie_rodata_end);
  160. } else {
  161. pr_info("out-of-bounds PIE fenceposts! pie_rodata_start=%px pie_rodata_end=%px (span=%lu)"
  162. " core_layout.base+core_layout.text_size=%px rodata_end=%px\n",
  163. pie_rodata_start,
  164. pie_rodata_end,
  165. pie_rodata_end-pie_rodata_start,
  166. (char *)THIS_MODULE_BASE + THIS_MODULE_TEXT_SIZE,
  167. (char *)THIS_MODULE_BASE + THIS_MODULE_RO_SIZE);
  168. rodata_hash = 0;
  169. }
  170. /* note, "%pK" conceals the actual layout information. "%px" exposes
  171. * the true module start address, which is potentially useful to an
  172. * attacker.
  173. */
  174. pr_info("wolfCrypt container hashes (spans): %x (%lu) %x (%lu), module base %pK\n",
  175. text_hash, pie_text_end-pie_text_start,
  176. rodata_hash, pie_rodata_end-pie_rodata_start,
  177. THIS_MODULE_BASE);
  178. }
  179. #endif /* HAVE_LINUXKM_PIE_SUPPORT */
  180. #ifdef HAVE_FIPS
  181. ret = wolfCrypt_SetCb_fips(lkmFipsCb);
  182. if (ret != 0) {
  183. pr_err("wolfCrypt_SetCb_fips() failed: %s\n", wc_GetErrorString(ret));
  184. return -ECANCELED;
  185. }
  186. fipsEntry();
  187. ret = wolfCrypt_GetStatus_fips();
  188. if (ret != 0) {
  189. pr_err("wolfCrypt_GetStatus_fips() failed: %s\n", wc_GetErrorString(ret));
  190. if (ret == IN_CORE_FIPS_E) {
  191. const char *newhash = wolfCrypt_GetCoreHash_fips();
  192. pr_err("Update verifyCore[] in fips_test.c with new hash \"%s\" and rebuild.\n",
  193. newhash ? newhash : "<null>");
  194. }
  195. return -ECANCELED;
  196. }
  197. pr_info("wolfCrypt FIPS ["
  198. #if defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION == 3)
  199. "ready"
  200. #elif defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION == 2) \
  201. && defined(WOLFCRYPT_FIPS_RAND)
  202. "140-2 rand"
  203. #elif defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION == 2)
  204. "140-2"
  205. #else
  206. "140"
  207. #endif
  208. "] POST succeeded.\n");
  209. #endif /* HAVE_FIPS */
  210. #ifdef WOLFCRYPT_ONLY
  211. ret = wolfCrypt_Init();
  212. if (ret != 0) {
  213. pr_err("wolfCrypt_Init() failed: %s\n", wc_GetErrorString(ret));
  214. return -ECANCELED;
  215. }
  216. #else
  217. ret = wolfSSL_Init();
  218. if (ret != WOLFSSL_SUCCESS) {
  219. pr_err("wolfSSL_Init() failed: %s\n", wc_GetErrorString(ret));
  220. return -ECANCELED;
  221. }
  222. #endif
  223. #ifndef NO_CRYPT_TEST
  224. #ifdef WC_RNG_SEED_CB
  225. ret = wc_SetSeed_Cb(wc_GenerateSeed);
  226. if (ret == 0)
  227. #endif
  228. {
  229. ret = wolfcrypt_test(NULL);
  230. }
  231. if (ret < 0) {
  232. pr_err("wolfcrypt self-test failed with return code %d.\n", ret);
  233. (void)libwolfssl_cleanup();
  234. msleep(10);
  235. return -ECANCELED;
  236. }
  237. pr_info("wolfCrypt self-test passed.\n");
  238. #endif
  239. #ifdef WOLFCRYPT_ONLY
  240. pr_info("wolfCrypt " LIBWOLFSSL_VERSION_STRING " loaded%s"
  241. ".\nSee https://www.wolfssl.com/ for more information.\n"
  242. "wolfCrypt Copyright (C) 2006-present wolfSSL Inc. Licensed under " WOLFSSL_LICENSE ".\n",
  243. #ifdef CONFIG_MODULE_SIG
  244. THIS_MODULE->sig_ok ? " with valid module signature" : " without valid module signature"
  245. #else
  246. ""
  247. #endif
  248. );
  249. #else
  250. pr_info("wolfSSL " LIBWOLFSSL_VERSION_STRING " loaded%s"
  251. ".\nSee https://www.wolfssl.com/ for more information.\n"
  252. "wolfSSL Copyright (C) 2006-present wolfSSL Inc. Licensed under " WOLFSSL_LICENSE ".\n",
  253. #ifdef CONFIG_MODULE_SIG
  254. THIS_MODULE->sig_ok ? " with valid module signature" : " without valid module signature"
  255. #else
  256. ""
  257. #endif
  258. );
  259. #endif
  260. return 0;
  261. }
  262. module_init(wolfssl_init);
  263. #if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 0, 0)
  264. static void __exit wolfssl_exit(void)
  265. #else
  266. static void wolfssl_exit(void)
  267. #endif
  268. {
  269. (void)libwolfssl_cleanup();
  270. return;
  271. }
  272. module_exit(wolfssl_exit);
  273. MODULE_LICENSE(WOLFSSL_LICENSE);
  274. MODULE_AUTHOR("https://www.wolfssl.com/");
  275. MODULE_DESCRIPTION("libwolfssl cryptographic and protocol facilities");
  276. MODULE_VERSION(LIBWOLFSSL_VERSION_STRING);
  277. #ifdef USE_WOLFSSL_LINUXKM_PIE_REDIRECT_TABLE
  278. /* get_current() is an inline or macro, depending on the target -- sidestep the whole issue with a wrapper func. */
  279. static struct task_struct *my_get_current_thread(void) {
  280. return get_current();
  281. }
  282. /* ditto for preempt_count(). */
  283. static int my_preempt_count(void) {
  284. return preempt_count();
  285. }
  286. #if defined(WOLFSSL_LINUXKM_SIMD_X86) && (LINUX_VERSION_CODE < KERNEL_VERSION(5, 14, 0))
  287. static int my_copy_fpregs_to_fpstate(struct fpu *fpu) {
  288. return copy_fpregs_to_fpstate(fpu);
  289. }
  290. static void my_copy_kernel_to_fpregs(union fpregs_state *fpstate) {
  291. copy_kernel_to_fpregs(fpstate);
  292. }
  293. #endif
  294. static int set_up_wolfssl_linuxkm_pie_redirect_table(void) {
  295. memset(
  296. &wolfssl_linuxkm_pie_redirect_table,
  297. 0,
  298. sizeof wolfssl_linuxkm_pie_redirect_table);
  299. #ifndef __ARCH_MEMCMP_NO_REDIRECT
  300. wolfssl_linuxkm_pie_redirect_table.memcmp = memcmp;
  301. #endif
  302. #ifndef __ARCH_MEMCPY_NO_REDIRECT
  303. wolfssl_linuxkm_pie_redirect_table.memcpy = memcpy;
  304. #endif
  305. #ifndef __ARCH_MEMSET_NO_REDIRECT
  306. wolfssl_linuxkm_pie_redirect_table.memset = memset;
  307. #endif
  308. #ifndef __ARCH_MEMMOVE_NO_REDIRECT
  309. wolfssl_linuxkm_pie_redirect_table.memmove = memmove;
  310. #endif
  311. #ifndef __ARCH_STRCMP_NO_REDIRECT
  312. wolfssl_linuxkm_pie_redirect_table.strcmp = strcmp;
  313. #endif
  314. #ifndef __ARCH_STRNCMP_NO_REDIRECT
  315. wolfssl_linuxkm_pie_redirect_table.strncmp = strncmp;
  316. #endif
  317. #ifndef __ARCH_STRCASECMP_NO_REDIRECT
  318. wolfssl_linuxkm_pie_redirect_table.strcasecmp = strcasecmp;
  319. #endif
  320. #ifndef __ARCH_STRNCASECMP_NO_REDIRECT
  321. wolfssl_linuxkm_pie_redirect_table.strncasecmp = strncasecmp;
  322. #endif
  323. #ifndef __ARCH_STRLEN_NO_REDIRECT
  324. wolfssl_linuxkm_pie_redirect_table.strlen = strlen;
  325. #endif
  326. #ifndef __ARCH_STRSTR_NO_REDIRECT
  327. wolfssl_linuxkm_pie_redirect_table.strstr = strstr;
  328. #endif
  329. #ifndef __ARCH_STRNCPY_NO_REDIRECT
  330. wolfssl_linuxkm_pie_redirect_table.strncpy = strncpy;
  331. #endif
  332. #ifndef __ARCH_STRNCAT_NO_REDIRECT
  333. wolfssl_linuxkm_pie_redirect_table.strncat = strncat;
  334. #endif
  335. wolfssl_linuxkm_pie_redirect_table.kstrtoll = kstrtoll;
  336. #if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 15, 0)
  337. wolfssl_linuxkm_pie_redirect_table._printk = _printk;
  338. #else
  339. wolfssl_linuxkm_pie_redirect_table.printk = printk;
  340. #endif
  341. wolfssl_linuxkm_pie_redirect_table.snprintf = snprintf;
  342. wolfssl_linuxkm_pie_redirect_table._ctype = _ctype;
  343. wolfssl_linuxkm_pie_redirect_table.kmalloc = kmalloc;
  344. wolfssl_linuxkm_pie_redirect_table.kfree = kfree;
  345. wolfssl_linuxkm_pie_redirect_table.ksize = ksize;
  346. wolfssl_linuxkm_pie_redirect_table.krealloc = krealloc;
  347. #ifdef HAVE_KVMALLOC
  348. wolfssl_linuxkm_pie_redirect_table.kvmalloc_node = kvmalloc_node;
  349. wolfssl_linuxkm_pie_redirect_table.kvfree = kvfree;
  350. #endif
  351. wolfssl_linuxkm_pie_redirect_table.is_vmalloc_addr = is_vmalloc_addr;
  352. #if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 1, 0)
  353. wolfssl_linuxkm_pie_redirect_table.kmalloc_trace =
  354. kmalloc_trace;
  355. #else
  356. wolfssl_linuxkm_pie_redirect_table.kmem_cache_alloc_trace =
  357. kmem_cache_alloc_trace;
  358. wolfssl_linuxkm_pie_redirect_table.kmalloc_order_trace =
  359. kmalloc_order_trace;
  360. #endif
  361. wolfssl_linuxkm_pie_redirect_table.get_random_bytes = get_random_bytes;
  362. #if LINUX_VERSION_CODE < KERNEL_VERSION(4, 0, 0)
  363. wolfssl_linuxkm_pie_redirect_table.getnstimeofday =
  364. getnstimeofday;
  365. #elif LINUX_VERSION_CODE < KERNEL_VERSION(5, 0, 0)
  366. wolfssl_linuxkm_pie_redirect_table.current_kernel_time64 =
  367. current_kernel_time64;
  368. #else
  369. wolfssl_linuxkm_pie_redirect_table.ktime_get_coarse_real_ts64 =
  370. ktime_get_coarse_real_ts64;
  371. #endif
  372. wolfssl_linuxkm_pie_redirect_table.get_current = my_get_current_thread;
  373. wolfssl_linuxkm_pie_redirect_table.preempt_count = my_preempt_count;
  374. #ifdef WOLFSSL_LINUXKM_SIMD_X86
  375. wolfssl_linuxkm_pie_redirect_table.irq_fpu_usable = irq_fpu_usable;
  376. #ifdef kernel_fpu_begin
  377. wolfssl_linuxkm_pie_redirect_table.kernel_fpu_begin_mask =
  378. kernel_fpu_begin_mask;
  379. #else
  380. wolfssl_linuxkm_pie_redirect_table.kernel_fpu_begin =
  381. kernel_fpu_begin;
  382. #endif
  383. wolfssl_linuxkm_pie_redirect_table.kernel_fpu_end = kernel_fpu_end;
  384. #ifdef LINUXKM_SIMD_IRQ
  385. #if LINUX_VERSION_CODE < KERNEL_VERSION(5, 14, 0)
  386. wolfssl_linuxkm_pie_redirect_table.copy_fpregs_to_fpstate = my_copy_fpregs_to_fpstate;
  387. wolfssl_linuxkm_pie_redirect_table.copy_kernel_to_fpregs = my_copy_kernel_to_fpregs;
  388. #elif LINUX_VERSION_CODE < KERNEL_VERSION(5, 16, 0)
  389. wolfssl_linuxkm_pie_redirect_table.save_fpregs_to_fpstate = save_fpregs_to_fpstate;
  390. wolfssl_linuxkm_pie_redirect_table.__restore_fpregs_from_fpstate = __restore_fpregs_from_fpstate;
  391. wolfssl_linuxkm_pie_redirect_table.xfeatures_mask_all = &xfeatures_mask_all;
  392. /*
  393. * #else
  394. * wolfssl_linuxkm_pie_redirect_table.save_fpregs_to_fpstate = save_fpregs_to_fpstate;
  395. * wolfssl_linuxkm_pie_redirect_table.restore_fpregs_from_fpstate = restore_fpregs_from_fpstate;
  396. * wolfssl_linuxkm_pie_redirect_table.fpu_kernel_cfg = &fpu_kernel_cfg;
  397. */
  398. #endif
  399. #endif
  400. wolfssl_linuxkm_pie_redirect_table.cpu_number = &cpu_number;
  401. wolfssl_linuxkm_pie_redirect_table.nr_cpu_ids = &nr_cpu_ids;
  402. #endif
  403. wolfssl_linuxkm_pie_redirect_table.__mutex_init = __mutex_init;
  404. #if LINUX_VERSION_CODE < KERNEL_VERSION(4, 0, 0)
  405. wolfssl_linuxkm_pie_redirect_table.mutex_lock_nested = mutex_lock_nested;
  406. #else
  407. wolfssl_linuxkm_pie_redirect_table.mutex_lock = mutex_lock;
  408. #endif
  409. wolfssl_linuxkm_pie_redirect_table.mutex_unlock = mutex_unlock;
  410. #if LINUX_VERSION_CODE < KERNEL_VERSION(4, 0, 0)
  411. wolfssl_linuxkm_pie_redirect_table.mutex_destroy = mutex_destroy;
  412. #endif
  413. #ifdef HAVE_FIPS
  414. wolfssl_linuxkm_pie_redirect_table.wolfCrypt_FIPS_first =
  415. wolfCrypt_FIPS_first;
  416. wolfssl_linuxkm_pie_redirect_table.wolfCrypt_FIPS_last =
  417. wolfCrypt_FIPS_last;
  418. #endif
  419. #if !defined(WOLFCRYPT_ONLY) && !defined(NO_CERTS)
  420. wolfssl_linuxkm_pie_redirect_table.GetCA = GetCA;
  421. #ifndef NO_SKID
  422. wolfssl_linuxkm_pie_redirect_table.GetCAByName = GetCAByName;
  423. #endif
  424. #endif
  425. /* runtime assert that the table has no null slots after initialization. */
  426. {
  427. unsigned long *i;
  428. for (i = (unsigned long *)&wolfssl_linuxkm_pie_redirect_table;
  429. i < (unsigned long *)&wolfssl_linuxkm_pie_redirect_table._last_slot;
  430. ++i)
  431. if (*i == 0) {
  432. pr_err("wolfCrypt container redirect table initialization was incomplete.\n");
  433. return -EFAULT;
  434. }
  435. }
  436. return 0;
  437. }
  438. #endif /* USE_WOLFSSL_LINUXKM_PIE_REDIRECT_TABLE */
  439. #ifdef WOLFCRYPT_FIPS_CORE_DYNAMIC_HASH_VALUE
  440. #include <wolfssl/wolfcrypt/coding.h>
  441. PRAGMA_GCC_DIAG_PUSH;
  442. PRAGMA_GCC("GCC diagnostic ignored \"-Wnested-externs\"");
  443. PRAGMA_GCC("GCC diagnostic ignored \"-Wpointer-arith\"");
  444. #include <crypto/hash.h>
  445. PRAGMA_GCC_DIAG_POP;
  446. extern char verifyCore[WC_SHA256_DIGEST_SIZE*2 + 1];
  447. extern const char coreKey[WC_SHA256_DIGEST_SIZE*2 + 1];
  448. extern const unsigned int wolfCrypt_FIPS_ro_start[];
  449. extern const unsigned int wolfCrypt_FIPS_ro_end[];
  450. #define FIPS_IN_CORE_KEY_SZ 32
  451. #define FIPS_IN_CORE_VERIFY_SZ FIPS_IN_CORE_KEY_SZ
  452. typedef int (*fips_address_function)(void);
  453. #define MAX_FIPS_DATA_SZ 100000
  454. #define MAX_FIPS_CODE_SZ 1000000
  455. extern int GenBase16_Hash(const byte* in, int length, char* out, int outSz);
  456. static int updateFipsHash(void)
  457. {
  458. struct crypto_shash *tfm = NULL;
  459. struct shash_desc *desc = NULL;
  460. word32 verifySz = FIPS_IN_CORE_VERIFY_SZ;
  461. word32 binCoreSz = FIPS_IN_CORE_KEY_SZ;
  462. int ret;
  463. byte *hash = NULL;
  464. char *base16_hash = NULL;
  465. byte *binCoreKey = NULL;
  466. byte *binVerify = NULL;
  467. fips_address_function first = wolfCrypt_FIPS_first;
  468. fips_address_function last = wolfCrypt_FIPS_last;
  469. char* start = (char*)wolfCrypt_FIPS_ro_start;
  470. char* end = (char*)wolfCrypt_FIPS_ro_end;
  471. unsigned long code_sz = (unsigned long)last - (unsigned long)first;
  472. unsigned long data_sz = (unsigned long)end - (unsigned long)start;
  473. if (data_sz == 0 || data_sz > MAX_FIPS_DATA_SZ)
  474. return BAD_FUNC_ARG; /* bad fips data size */
  475. if (code_sz == 0 || code_sz > MAX_FIPS_CODE_SZ)
  476. return BAD_FUNC_ARG; /* bad fips code size */
  477. hash = XMALLOC(WC_SHA256_DIGEST_SIZE, 0, DYNAMIC_TYPE_TMP_BUFFER);
  478. if (hash == NULL) {
  479. ret = MEMORY_E;
  480. goto out;
  481. }
  482. base16_hash = XMALLOC(WC_SHA256_DIGEST_SIZE*2 + 1, 0, DYNAMIC_TYPE_TMP_BUFFER);
  483. if (base16_hash == NULL) {
  484. ret = MEMORY_E;
  485. goto out;
  486. }
  487. binCoreKey = XMALLOC(binCoreSz, 0, DYNAMIC_TYPE_TMP_BUFFER);
  488. if (binCoreKey == NULL) {
  489. ret = MEMORY_E;
  490. goto out;
  491. }
  492. binVerify = XMALLOC(verifySz, 0, DYNAMIC_TYPE_TMP_BUFFER);
  493. if (binVerify == NULL) {
  494. ret = MEMORY_E;
  495. goto out;
  496. }
  497. {
  498. word32 base16_out_len = binCoreSz;
  499. ret = Base16_Decode((const byte *)coreKey, sizeof coreKey - 1, binCoreKey, &base16_out_len);
  500. if (ret != 0) {
  501. pr_err("Base16_Decode for coreKey: %s\n", wc_GetErrorString(ret));
  502. goto out;
  503. }
  504. if (base16_out_len != binCoreSz) {
  505. pr_err("unexpected output length %u for coreKey from Base16_Decode.\n",base16_out_len);
  506. ret = BAD_STATE_E;
  507. goto out;
  508. }
  509. }
  510. tfm = crypto_alloc_shash("hmac(sha256)", 0, 0);
  511. if (IS_ERR(tfm)) {
  512. if (PTR_ERR(tfm) == -ENOMEM) {
  513. pr_err("crypto_alloc_shash failed: out of memory\n");
  514. ret = MEMORY_E;
  515. } else if (PTR_ERR(tfm) == -ENOENT) {
  516. pr_err("crypto_alloc_shash failed: kernel is missing hmac(sha256) implementation\n");
  517. pr_err("check for CONFIG_CRYPTO_SHA256 and CONFIG_CRYPTO_HMAC.\n");
  518. ret = NOT_COMPILED_IN;
  519. } else {
  520. pr_err("crypto_alloc_shash failed with ret %ld\n",PTR_ERR(tfm));
  521. ret = HASH_TYPE_E;
  522. }
  523. tfm = NULL;
  524. goto out;
  525. }
  526. {
  527. size_t desc_size = crypto_shash_descsize(tfm) + sizeof *desc;
  528. desc = XMALLOC(desc_size, NULL, DYNAMIC_TYPE_TMP_BUFFER);
  529. if (desc == NULL) {
  530. pr_err("failed allocating desc.");
  531. ret = MEMORY_E;
  532. goto out;
  533. }
  534. XMEMSET(desc, 0, desc_size);
  535. }
  536. ret = crypto_shash_setkey(tfm, binCoreKey, binCoreSz);
  537. if (ret) {
  538. pr_err("crypto_ahash_setkey failed: err %d\n", ret);
  539. ret = BAD_STATE_E;
  540. goto out;
  541. }
  542. desc->tfm = tfm;
  543. ret = crypto_shash_init(desc);
  544. if (ret) {
  545. pr_err("crypto_shash_init failed: err %d\n", ret);
  546. ret = BAD_STATE_E;
  547. goto out;
  548. }
  549. ret = crypto_shash_update(desc, (byte *)(wc_ptr_t)first, (word32)code_sz);
  550. if (ret) {
  551. pr_err("crypto_shash_update failed: err %d\n", ret);
  552. ret = BAD_STATE_E;
  553. goto out;
  554. }
  555. /* don't hash verifyCore or changing verifyCore will change hash */
  556. if (verifyCore >= start && verifyCore < end) {
  557. data_sz = (unsigned long)verifyCore - (unsigned long)start;
  558. ret = crypto_shash_update(desc, (byte*)start, (word32)data_sz);
  559. if (ret) {
  560. pr_err("crypto_shash_update failed: err %d\n", ret);
  561. ret = BAD_STATE_E;
  562. goto out;
  563. }
  564. start = (char*)verifyCore + sizeof(verifyCore);
  565. data_sz = (unsigned long)end - (unsigned long)start;
  566. }
  567. ret = crypto_shash_update(desc, (byte*)start, (word32)data_sz);
  568. if (ret) {
  569. pr_err("crypto_shash_update failed: err %d\n", ret);
  570. ret = BAD_STATE_E;
  571. goto out;
  572. }
  573. ret = crypto_shash_final(desc, hash);
  574. if (ret) {
  575. pr_err("crypto_shash_final failed: err %d\n", ret);
  576. ret = BAD_STATE_E;
  577. goto out;
  578. }
  579. ret = GenBase16_Hash(hash, WC_SHA256_DIGEST_SIZE, base16_hash, WC_SHA256_DIGEST_SIZE*2 + 1);
  580. if (ret != 0) {
  581. pr_err("GenBase16_Hash failed: %s\n", wc_GetErrorString(ret));
  582. goto out;
  583. }
  584. {
  585. word32 base16_out_len = verifySz;
  586. ret = Base16_Decode((const byte *)verifyCore, sizeof verifyCore - 1, binVerify, &base16_out_len);
  587. if (ret != 0) {
  588. pr_err("Base16_Decode for verifyCore: %s\n", wc_GetErrorString(ret));
  589. goto out;
  590. }
  591. if (base16_out_len != binCoreSz) {
  592. pr_err("unexpected output length %u for verifyCore from Base16_Decode.\n",base16_out_len);
  593. ret = BAD_STATE_E;
  594. goto out;
  595. }
  596. }
  597. if (XMEMCMP(hash, binVerify, WC_SHA256_DIGEST_SIZE) == 0)
  598. pr_info("updateFipsHash: verifyCore already matches.\n");
  599. else {
  600. XMEMCPY(verifyCore, base16_hash, WC_SHA256_DIGEST_SIZE*2 + 1);
  601. pr_info("updateFipsHash: verifyCore updated.\n");
  602. }
  603. ret = 0;
  604. out:
  605. if (tfm != NULL)
  606. crypto_free_shash(tfm);
  607. if (desc != NULL)
  608. XFREE(desc, NULL, DYNAMIC_TYPE_TMP_BUFFER);
  609. if (hash != NULL)
  610. XFREE(hash, NULL, DYNAMIC_TYPE_TMP_BUFFER);
  611. if (base16_hash != NULL)
  612. XFREE(base16_hash, NULL, DYNAMIC_TYPE_TMP_BUFFER);
  613. if (binCoreKey != NULL)
  614. XFREE(binCoreKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
  615. if (binVerify != NULL)
  616. XFREE(binVerify, NULL, DYNAMIC_TYPE_TMP_BUFFER);
  617. return ret;
  618. }
  619. #endif /* WOLFCRYPT_FIPS_CORE_DYNAMIC_HASH_VALUE */