From nobody Sat Jan 11 02:49:00 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4YVNJY0cYDz5l4bY; Sat, 11 Jan 2025 02:49:01 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4YVNJX40Rcz4HhN; Sat, 11 Jan 2025 02:49:00 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1736563740; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=IiwKcC8jfAeIeBQYdU1Af757VDSGaXw+zaseQG0kEgE=; b=wZjdIj8h1lDeJ+QgzLS2EK91fS3DuYxY7jn/vmD44Mwzr6OrNmsTgvXOYu1oDaCk/dNwZq lpr/Ri1KzpWTsGgk6Oe70r7SPZikfNat1+5Xu7TeTMzgcjWEcGlRPoXItogAcqShOc3DsM v3N2iPvCwpS8aF94cCzCsYNpkceP9ozO3e3UYG6w77Jcw0MeG2yWvJMp4/ilstEfMSMzI8 TPZakbUGsgIN8pm5UvbKHuIGDfqFEzx+oBEylhNfsVDvBlWLl7ZfeT7pCGC5B/TiBTkqwu Y257mr4kpEEvo0I6c+n/Xi0AOh6KiJ47tdTe5ZUtFgNybeGQuc1kkbnhHOOyTQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1736563740; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=IiwKcC8jfAeIeBQYdU1Af757VDSGaXw+zaseQG0kEgE=; b=WOagM149y+ukuAwC+bgSdGth/TawXQPTyIncfd3gcka5oMpuaBanPbn7HN0JMa8WpBxAvN k3WLmWT3vB7OsAQr7COg37VASGku49eKRR5jIqC9i2j2H0ldtCCy1Z7wqtQsg25iBfs/H/ DLehO7/i4XlZ26vUxL5lyqmCKZm/oJgxGlx+q9A0D7zsc0ad0RyP5PLX/Fo/aXFEgHOC9d Tu8oe2IICtECjoG7uMOGfyiIEwg/Fu3F40S5t+2FOVzawClSWS29s1+iKBGRR/WxLUQflc 8405ipRsjaNfGIxm3HfJjZPlRu5gEt3OtbjqTeytIvwZvYZDuQEdccp1pKoLdw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1736563740; a=rsa-sha256; cv=none; b=oqNzEJ4qh1cHdzY0s/aeQk84Sd8DExVdZIz+rUDLHOvi1GvSFKEs/TAoOFeMf5PA4qoHk+ xPAIK4y1UXBNyV2EMmhHH2rEPSVChvnp2V0rfa5XGmk6URE9ByEpVHzyuITSXA06/b16cf jqgRTgTwfvOqmPYNCvakY2ik4XFgu5nR9YGxwFwS+u4lzNydzEuKjQYL3nirzEr+3RFynB CykdwNlJ0nQihfkB+uUg0Lx2/NXkGULjO+6jVE31xJWnWyMkfzZFvuds/X8dEFaYR47Mu+ 1QRXi70cEamfN+0LYWqC4e8cWaHIG1DuAGZ6Sp+pjTC5Gbsrg1B3u/VvR4cy0g== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4YVNJX2tf9zgYv; Sat, 11 Jan 2025 02:49:00 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 50B2n0CO066375; Sat, 11 Jan 2025 02:49:00 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 50B2n0re066372; Sat, 11 Jan 2025 02:49:00 GMT (envelope-from git) Date: Sat, 11 Jan 2025 02:49:00 GMT Message-Id: <202501110249.50B2n0re066372@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Kyle Evans Subject: git: e993a99fd862 - stable/13 - secure: hook up libecc as libpkgecc List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kevans X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: e993a99fd86267a6ea6a7925bf05d3f26730ee9c Auto-Submitted: auto-generated The branch stable/13 has been updated by kevans: URL: https://cgit.FreeBSD.org/src/commit/?id=e993a99fd86267a6ea6a7925bf05d3f26730ee9c commit e993a99fd86267a6ea6a7925bf05d3f26730ee9c Author: Kyle Evans AuthorDate: 2025-01-01 21:10:27 +0000 Commit: Kyle Evans CommitDate: 2025-01-11 02:48:29 +0000 secure: hook up libecc as libpkgecc libecc is not intended to be general use, other applications should really be using openssl. pkg(7) uses libecc to align with the pkg(8) project and its goals. This will be used in the upcoming support for ECC in pkg(7). Reviewed by: emaste (cherry picked from commit 05427f4639bcf2703329a9be9d25ec09bb782742) --- secure/lib/Makefile | 2 +- secure/lib/libpkgecc/Makefile | 137 +++++++++++++++++++++++++++++++++ secure/lib/libpkgecc/pkg_libecc_rand.c | 22 ++++++ share/mk/src.libnames.mk | 4 + 4 files changed, 164 insertions(+), 1 deletion(-) diff --git a/secure/lib/Makefile b/secure/lib/Makefile index b4b586fa6585..bc659916e152 100644 --- a/secure/lib/Makefile +++ b/secure/lib/Makefile @@ -1,7 +1,7 @@ .include -SUBDIR= +SUBDIR= libpkgecc .if ${MK_OPENSSL} != "no" SUBDIR+=libcrypto libssl .if ${MK_OPENSSH} != "no" diff --git a/secure/lib/libpkgecc/Makefile b/secure/lib/libpkgecc/Makefile new file mode 100644 index 000000000000..476cd8635aeb --- /dev/null +++ b/secure/lib/libpkgecc/Makefile @@ -0,0 +1,137 @@ + +# STOP - This is not a general purpose library and is only for use by pkg(7) +# to align with the implementation in pkg(8). +LIB= pkgecc +INTERNALLIB= + +.PATH: $(SRCTOP)/crypto/libecc +SRCS+= pkg_libecc_rand.c + +# curves_mod_src +.PATH: $(SRCTOP)/crypto/libecc/src/curves +SRCS+= aff_pt.c \ + aff_pt_montgomery.c \ + ec_edwards.c \ + ec_montgomery.c \ + ec_params.c \ + ec_shortw.c \ + aff_pt_edwards.c \ + curves.c \ + prj_pt.c + +# utils_ec_src +.PATH: $(SRCTOP)/crypto/libecc/src/utils +SRCS+= print_curves.c + +# fp_mod_src +.PATH: $(SRCTOP)/crypto/libecc/src/fp +SRCS+= fp_add.c \ + fp.c \ + fp_montgomery.c \ + fp_mul.c \ + fp_mul_redc1.c \ + fp_pow.c \ + fp_rand.c \ + fp_sqrt.c + +# nn_mod_src +.PATH: $(SRCTOP)/crypto/libecc/src/nn +SRCS+= nn_add.c \ + nn.c \ + nn_div.c \ + nn_logical.c \ + nn_modinv.c \ + nn_mod_pow.c \ + nn_mul.c \ + nn_mul_redc1.c \ + nn_rand.c + +# utils_arith_src +SRCS+= utils.c \ + utils_rand.c \ + print_buf.c \ + print_fp.c \ + print_nn.c + +## libsign bits +# hash_mod_src +.PATH: $(SRCTOP)/crypto/libecc/src/hash +SRCS+= hash_algs.c \ + sm3.c \ + streebog.c \ + ripemd160.c \ + belt-hash.c \ + hmac.c \ + bash224.c \ + bash256.c \ + bash384.c \ + bash512.c \ + bash.c \ + sha224.c \ + sha256.c \ + sha3-224.c \ + sha3-256.c \ + sha3-384.c \ + sha3-512.c \ + sha384.c \ + sha3.c \ + sha512-224.c \ + sha512-256.c \ + sha512.c \ + sha512_core.c \ + shake256.c \ + shake.c + +# sig_mod_src +.PATH: $(SRCTOP)/crypto/libecc/src/sig +SRCS+= decdsa.c \ + ecdsa.c \ + ecfsdsa.c \ + ecgdsa.c \ + eckcdsa.c \ + ecosdsa.c \ + ecrdsa.c \ + ecsdsa.c \ + eddsa.c \ + fuzzing_ecdsa.c \ + fuzzing_ecgdsa.c \ + fuzzing_ecrdsa.c \ + ecdsa_common.c \ + ecsdsa_common.c \ + sig_algs.c \ + sm2.c \ + bign_common.c \ + bign.c \ + dbign.c \ + bip0340.c + +# key_mod_src +SRCS+= ec_key.c + +# utils_sign_src +.PATH: $(SRCTOP)/crypto/libecc/src/sig +SRCS+= print_keys.c + +# ecdh_mod_src +.PATH: $(SRCTOP)/crypto/libecc/src/ecdh +SRCS+= ecccdh.c \ + x25519_448.c + +# external_deps +.PATH: $(SRCTOP)/crypto/libecc/src/external_deps +SRCS+= print.c + +CONFLICTS= -Dsha256_init=_libecc_sha256_init \ + -Dsha256_update=_libecc_sha256_update \ + -Dsha256_final=_libecc_sha256_final \ + -Dsha512_224_init=_libecc_sha512_224_init \ + -Dsha512_256_init=_libecc_sha512_256_init + +CFLAGS= -I$(SRCTOP)/crypto/libecc/include \ + -ffreestanding \ + -fno-builtin \ + -DUSE_WARN_UNUSED_RET \ + -DWITH_STDLIB \ + $(CONFLICTS) + +.include diff --git a/secure/lib/libpkgecc/pkg_libecc_rand.c b/secure/lib/libpkgecc/pkg_libecc_rand.c new file mode 100644 index 000000000000..c190c9094538 --- /dev/null +++ b/secure/lib/libpkgecc/pkg_libecc_rand.c @@ -0,0 +1,22 @@ +/* SPDX-License-Identifier: Unlicense */ +#include +#include + +#include + +int +get_random(unsigned char *buf, uint16_t len) +{ + + /* + * We need random numbers even in a sandbox, so we can't use + * /dev/urandom as the external_deps version of get_random() does on + * FreeBSD. arc4random_buf() is a better choice because it uses the + * underlying getrandom(2) instead of needing to open a device handle. + * + * We don't have any guarantees that this won't open a device on other + * platforms, but we also don't do any sandboxing on those platforms. + */ + arc4random_buf(buf, len); + return 0; +} diff --git a/share/mk/src.libnames.mk b/share/mk/src.libnames.mk index c372614037c7..aae78f1f5947 100644 --- a/share/mk/src.libnames.mk +++ b/share/mk/src.libnames.mk @@ -59,6 +59,7 @@ _INTERNALLIBS= \ parse \ pe \ pfctl \ + pkgecc \ pmcstat \ sl \ sm \ @@ -605,6 +606,9 @@ LIBAMU?= ${LIBAMUDIR}/libamu${PIE_SUFFIX}.a LIBBE?= ${LIBBEDIR}/libbe${PIE_SUFFIX}.a +LIBPKGECCDIR= ${_LIB_OBJTOP}/secure/lib/libpkgecc +LIBPKGECC?= ${LIBPKGECCDIR}/libpkgecc${PIE_SUFFIX}.a + LIBPMCSTATDIR= ${_LIB_OBJTOP}/lib/libpmcstat LIBPMCSTAT?= ${LIBPMCSTATDIR}/libpmcstat${PIE_SUFFIX}.a