From nobody Sat Jan 11 02:48:55 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4YVNJS0bD7z5l4Q8; Sat, 11 Jan 2025 02:48:56 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4YVNJR2tF8z4Hbq; Sat, 11 Jan 2025 02:48:55 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1736563735; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BnM9G+CjUiQi09D1FXYj+46wwAb2/tXpChXj9rVxUn4=; b=Wpkfwu3s4lPFcF+oH0MyoCsV9SWCj6i+6hW3uSIykIdtIYGhNnix4XNNbLSU/FOXRBLdXH Mba7StewW+8pyCxiTgW2ubPia9cyHFcTeS3wRlcqcfQOvxvTXElYfSzhvZ9ZFfv8BqbYbi uEhV394V5tS4484Ffvvl3fSW6YNuST/yH2uMHgtve/TCO8SSTg3gvvlXc6gpYzszzHfWHP eaIHHsBIEhj46EfmdbH2kOY80jS/gbNIXCAt/Ej45YW+rwpqtP+4DHFeMEwEMYfUEPKY60 Vc/r3TuanWQUlZ8LhY9PjxGDZJELNSLDzv3dc0T2n6u2a9X6Dxw6PuxcwXIiiQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1736563735; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BnM9G+CjUiQi09D1FXYj+46wwAb2/tXpChXj9rVxUn4=; b=pYP8IiVro1dTvaNmj5FtCgpJhsB6MKP1n5kbfC1Xnxn+0PKfOpJQ85FiLrmDgKcgZ60Wov tLxpu9F1E74rcZ8amzB/xaHu17MLV18R5Ye8RpiVSAnMRhO2iG31XzJZB2ARwcmIQdfo28 N1AdpBBNnQSIjGU3GfDbSeXgpvhvaRIv1wEGYmJeCClqvk/RZd2XmU9/9iMBcKp0/btl2e xQtQHMVBPa0occv4wYzZsLyKRUCjoZ1Hho0ZWZPPnN6uKJPkzZXMU6Bs/OHZjWpIn32Tp1 4VzSpiXfewMa4hutvifky1Ojfa1Hloc60tYM607pWAwX39k7rBUAh/jZcCSufA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1736563735; a=rsa-sha256; cv=none; b=JmtInxaq0KC3UiovWRr76ghxW71g4xLIl6xaoSzVvAkSEV5+z/5XnPJyg99kx0AUSiVKH0 HTOY18w7akE/aal95F3s2h5Jsqe3pu+VZ+UGXp+hCewvgASplD4bZVPAemf2E34QAqXdiV Gdna6SNkZuGrmKEO1hJ3yfk0pXV+qo90O2mHD17tv/k+N4skj1Bf24bs8n8/UB6YT1jKnx 9iqVDizSz2K7SQ/+dgkNVu6k6pa3KRsMSITg0qWrGxuzSHVyr/2t4noGUI3+5+7nm//Djo ZV1FENcQivrVw1mmdYKjoOONE5LlDFPkVGHjRdS5KKydy6urUd0cq5cVENvTlw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4YVNJR1yR9zgY7; Sat, 11 Jan 2025 02:48:55 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 50B2mtV6066100; Sat, 11 Jan 2025 02:48:55 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 50B2mtai066097; Sat, 11 Jan 2025 02:48:55 GMT (envelope-from git) Date: Sat, 11 Jan 2025 02:48:55 GMT Message-Id: <202501110248.50B2mtai066097@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Kyle Evans Subject: git: 616156f8e6ea - stable/14 - secure: hook up libecc as libpkgecc List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kevans X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 616156f8e6eaefe5e3e0df6621129f4bf9003344 Auto-Submitted: auto-generated The branch stable/14 has been updated by kevans: URL: https://cgit.FreeBSD.org/src/commit/?id=616156f8e6eaefe5e3e0df6621129f4bf9003344 commit 616156f8e6eaefe5e3e0df6621129f4bf9003344 Author: Kyle Evans AuthorDate: 2025-01-01 21:10:27 +0000 Commit: Kyle Evans CommitDate: 2025-01-11 02:48:24 +0000 secure: hook up libecc as libpkgecc libecc is not intended to be general use, other applications should really be using openssl. pkg(7) uses libecc to align with the pkg(8) project and its goals. This will be used in the upcoming support for ECC in pkg(7). Reviewed by: emaste (cherry picked from commit 05427f4639bcf2703329a9be9d25ec09bb782742) --- secure/lib/Makefile | 2 +- secure/lib/libpkgecc/Makefile | 137 +++++++++++++++++++++++++++++++++ secure/lib/libpkgecc/pkg_libecc_rand.c | 22 ++++++ share/mk/src.libnames.mk | 4 + 4 files changed, 164 insertions(+), 1 deletion(-) diff --git a/secure/lib/Makefile b/secure/lib/Makefile index b4b586fa6585..bc659916e152 100644 --- a/secure/lib/Makefile +++ b/secure/lib/Makefile @@ -1,7 +1,7 @@ .include -SUBDIR= +SUBDIR= libpkgecc .if ${MK_OPENSSL} != "no" SUBDIR+=libcrypto libssl .if ${MK_OPENSSH} != "no" diff --git a/secure/lib/libpkgecc/Makefile b/secure/lib/libpkgecc/Makefile new file mode 100644 index 000000000000..476cd8635aeb --- /dev/null +++ b/secure/lib/libpkgecc/Makefile @@ -0,0 +1,137 @@ + +# STOP - This is not a general purpose library and is only for use by pkg(7) +# to align with the implementation in pkg(8). +LIB= pkgecc +INTERNALLIB= + +.PATH: $(SRCTOP)/crypto/libecc +SRCS+= pkg_libecc_rand.c + +# curves_mod_src +.PATH: $(SRCTOP)/crypto/libecc/src/curves +SRCS+= aff_pt.c \ + aff_pt_montgomery.c \ + ec_edwards.c \ + ec_montgomery.c \ + ec_params.c \ + ec_shortw.c \ + aff_pt_edwards.c \ + curves.c \ + prj_pt.c + +# utils_ec_src +.PATH: $(SRCTOP)/crypto/libecc/src/utils +SRCS+= print_curves.c + +# fp_mod_src +.PATH: $(SRCTOP)/crypto/libecc/src/fp +SRCS+= fp_add.c \ + fp.c \ + fp_montgomery.c \ + fp_mul.c \ + fp_mul_redc1.c \ + fp_pow.c \ + fp_rand.c \ + fp_sqrt.c + +# nn_mod_src +.PATH: $(SRCTOP)/crypto/libecc/src/nn +SRCS+= nn_add.c \ + nn.c \ + nn_div.c \ + nn_logical.c \ + nn_modinv.c \ + nn_mod_pow.c \ + nn_mul.c \ + nn_mul_redc1.c \ + nn_rand.c + +# utils_arith_src +SRCS+= utils.c \ + utils_rand.c \ + print_buf.c \ + print_fp.c \ + print_nn.c + +## libsign bits +# hash_mod_src +.PATH: $(SRCTOP)/crypto/libecc/src/hash +SRCS+= hash_algs.c \ + sm3.c \ + streebog.c \ + ripemd160.c \ + belt-hash.c \ + hmac.c \ + bash224.c \ + bash256.c \ + bash384.c \ + bash512.c \ + bash.c \ + sha224.c \ + sha256.c \ + sha3-224.c \ + sha3-256.c \ + sha3-384.c \ + sha3-512.c \ + sha384.c \ + sha3.c \ + sha512-224.c \ + sha512-256.c \ + sha512.c \ + sha512_core.c \ + shake256.c \ + shake.c + +# sig_mod_src +.PATH: $(SRCTOP)/crypto/libecc/src/sig +SRCS+= decdsa.c \ + ecdsa.c \ + ecfsdsa.c \ + ecgdsa.c \ + eckcdsa.c \ + ecosdsa.c \ + ecrdsa.c \ + ecsdsa.c \ + eddsa.c \ + fuzzing_ecdsa.c \ + fuzzing_ecgdsa.c \ + fuzzing_ecrdsa.c \ + ecdsa_common.c \ + ecsdsa_common.c \ + sig_algs.c \ + sm2.c \ + bign_common.c \ + bign.c \ + dbign.c \ + bip0340.c + +# key_mod_src +SRCS+= ec_key.c + +# utils_sign_src +.PATH: $(SRCTOP)/crypto/libecc/src/sig +SRCS+= print_keys.c + +# ecdh_mod_src +.PATH: $(SRCTOP)/crypto/libecc/src/ecdh +SRCS+= ecccdh.c \ + x25519_448.c + +# external_deps +.PATH: $(SRCTOP)/crypto/libecc/src/external_deps +SRCS+= print.c + +CONFLICTS= -Dsha256_init=_libecc_sha256_init \ + -Dsha256_update=_libecc_sha256_update \ + -Dsha256_final=_libecc_sha256_final \ + -Dsha512_224_init=_libecc_sha512_224_init \ + -Dsha512_256_init=_libecc_sha512_256_init + +CFLAGS= -I$(SRCTOP)/crypto/libecc/include \ + -ffreestanding \ + -fno-builtin \ + -DUSE_WARN_UNUSED_RET \ + -DWITH_STDLIB \ + $(CONFLICTS) + +.include diff --git a/secure/lib/libpkgecc/pkg_libecc_rand.c b/secure/lib/libpkgecc/pkg_libecc_rand.c new file mode 100644 index 000000000000..c190c9094538 --- /dev/null +++ b/secure/lib/libpkgecc/pkg_libecc_rand.c @@ -0,0 +1,22 @@ +/* SPDX-License-Identifier: Unlicense */ +#include +#include + +#include + +int +get_random(unsigned char *buf, uint16_t len) +{ + + /* + * We need random numbers even in a sandbox, so we can't use + * /dev/urandom as the external_deps version of get_random() does on + * FreeBSD. arc4random_buf() is a better choice because it uses the + * underlying getrandom(2) instead of needing to open a device handle. + * + * We don't have any guarantees that this won't open a device on other + * platforms, but we also don't do any sandboxing on those platforms. + */ + arc4random_buf(buf, len); + return 0; +} diff --git a/share/mk/src.libnames.mk b/share/mk/src.libnames.mk index 9cba6c8cc7c3..837d6f842da3 100644 --- a/share/mk/src.libnames.mk +++ b/share/mk/src.libnames.mk @@ -61,6 +61,7 @@ _INTERNALLIBS= \ parse \ pe \ pfctl \ + pkgecc \ pmcstat \ sl \ sm \ @@ -616,6 +617,9 @@ LIBBSNMPTOOLS?= ${LIBBSNMPTOOLSDIR}/libbsnmptools${PIE_SUFFIX}.a LIBBE?= ${LIBBEDIR}/libbe${PIE_SUFFIX}.a +LIBPKGECCDIR= ${_LIB_OBJTOP}/secure/lib/libpkgecc +LIBPKGECC?= ${LIBPKGECCDIR}/libpkgecc${PIE_SUFFIX}.a + LIBPMCSTATDIR= ${_LIB_OBJTOP}/lib/libpmcstat LIBPMCSTAT?= ${LIBPMCSTATDIR}/libpmcstat${PIE_SUFFIX}.a