Skip to content

Commit 20d66c0

Browse files
lws-teamlws-team
committed
jws-alignment-with-gnutls
1 parent 2ace1ba commit 20d66c0

File tree

8 files changed

+266
-81
lines changed

8 files changed

+266
-81
lines changed

‎include/libwebsockets/lws-genaes.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,7 @@ struct lws_genaes_ctx {
9090
} u;
9191
#elif defined(LWS_WITH_GNUTLS)
9292
gnutls_cipher_hd_t ctx;
93+
int gnutls_gcm_initialized;
9394
#else
9495
EVP_CIPHER_CTX *ctx;
9596
const EVP_CIPHER *cipher;

‎lib/jose/jwe/jwe-rsa-aescbc.c‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -97,13 +97,14 @@ lws_jwe_encrypt_rsa_aes_cbc_hs(struct lws_jwe *jwe,
9797
return -1;
9898
}
9999

100-
if (lws_genrsa_create(&rsactx, jwe->jws.jwk->e, jwe->jws.context,
100+
int res = lws_genrsa_create(&rsactx, jwe->jws.jwk->e, jwe->jws.context,
101101
!strcmp(jwe->jose.alg->alg, "RSA-OAEP") ?
102102
LGRSAM_PKCS1_OAEP_PSS : LGRSAM_PKCS1_1_5,
103-
LWS_GENHASH_TYPE_UNKNOWN)) {
103+
LWS_GENHASH_TYPE_UNKNOWN);
104+
if (res) {
104105
lwsl_notice("%s: lws_genrsa_create\n",
105106
__func__);
106-
return -1;
107+
return res < -1 ? res : -1;
107108
}
108109

109110
/* encrypt the CEK using RSA, mbedtls can't handle both in and out are
@@ -117,7 +118,7 @@ lws_jwe_encrypt_rsa_aes_cbc_hs(struct lws_jwe *jwe,
117118
lws_explicit_bzero(ekey, (unsigned int)hlen); /* cleanse the temp CEK copy */
118119
if (n < 0) {
119120
lwsl_err("%s: encrypt cek fail\n", __func__);
120-
return -1;
121+
return n < -1 ? n : -1;
121122
}
122123
jwe->jws.map.len[LJWE_EKEY] = (unsigned int)n; /* update to encrypted EKEY size */
123124

@@ -151,13 +152,14 @@ lws_jwe_auth_and_decrypt_rsa_aes_cbc_hs(struct lws_jwe *jwe)
151152

152153
/* Decrypt the JWE Encrypted Key to get the raw MAC || CEK */
153154

154-
if (lws_genrsa_create(&rsactx, jwe->jws.jwk->e, jwe->jws.context,
155+
int res = lws_genrsa_create(&rsactx, jwe->jws.jwk->e, jwe->jws.context,
155156
!strcmp(jwe->jose.alg->alg, "RSA-OAEP") ?
156157
LGRSAM_PKCS1_OAEP_PSS : LGRSAM_PKCS1_1_5,
157-
LWS_GENHASH_TYPE_UNKNOWN)) {
158+
LWS_GENHASH_TYPE_UNKNOWN);
159+
if (res) {
158160
lwsl_notice("%s: lws_genrsa_public_decrypt_create\n",
159161
__func__);
160-
return -1;
162+
return res < -1 ? res : -1;
161163
}
162164

163165
n = lws_genrsa_private_decrypt(&rsactx,
@@ -167,7 +169,7 @@ lws_jwe_auth_and_decrypt_rsa_aes_cbc_hs(struct lws_jwe *jwe)
167169
lws_genrsa_destroy(&rsactx);
168170
if (n < 0) {
169171
lwsl_err("%s: decrypt cek fail: \n", __func__);
170-
return -1;
172+
return n < -1 ? n : -1;
171173
}
172174

173175
n = lws_jwe_auth_and_decrypt_cbc_hs(jwe, enc_cek,

‎lib/jose/jwe/jwe-rsa-aesgcm.c‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -93,12 +93,14 @@ lws_jwe_encrypt_rsa_aes_gcm(struct lws_jwe *jwe, char *temp, int *temp_len)
9393

9494
/* Encrypt the CEK into EKEY to make the JWE Encrypted Key */
9595

96-
if (lws_genrsa_create(&rsactx, jwe->jws.jwk->e, jwe->jws.context,
96+
int res = lws_genrsa_create(&rsactx, jwe->jws.jwk->e, jwe->jws.context,
9797
!strcmp(jwe->jose.alg->alg, "RSA-OAEP") ?
9898
LGRSAM_PKCS1_OAEP_PSS : LGRSAM_PKCS1_1_5,
99-
LWS_GENHASH_TYPE_SHA1 /* !!! */)) {
99+
LWS_GENHASH_TYPE_SHA1 /* !!! */);
100+
if (res) {
100101
lwsl_notice("%s: lws_genrsa_public_decrypt_create\n",
101102
__func__);
103+
ret = res < -1 ? res : -1;
102104
goto bail;
103105
}
104106

@@ -107,6 +109,7 @@ lws_jwe_encrypt_rsa_aes_gcm(struct lws_jwe *jwe, char *temp, int *temp_len)
107109
lws_genrsa_destroy(&rsactx);
108110
if (n < 0) {
109111
lwsl_err("%s: encrypt cek fail: \n", __func__);
112+
ret = n < -1 ? n : -1;
110113
goto bail;
111114
}
112115

@@ -142,13 +145,14 @@ lws_jwe_auth_and_decrypt_rsa_aes_gcm(struct lws_jwe *jwe)
142145

143146
/* Decrypt the JWE Encrypted Key to get the direct CEK */
144147

145-
if (lws_genrsa_create(&rsactx, jwe->jws.jwk->e, jwe->jws.context,
148+
int res = lws_genrsa_create(&rsactx, jwe->jws.jwk->e, jwe->jws.context,
146149
!strcmp(jwe->jose.alg->alg, "RSA-OAEP") ?
147150
LGRSAM_PKCS1_OAEP_PSS : LGRSAM_PKCS1_1_5,
148-
LWS_GENHASH_TYPE_SHA1 /* !!! */)) {
151+
LWS_GENHASH_TYPE_SHA1 /* !!! */);
152+
if (res) {
149153
lwsl_notice("%s: lws_genrsa_public_decrypt_create\n",
150154
__func__);
151-
return -1;
155+
return res < -1 ? res : -1;
152156
}
153157

154158
n = lws_genrsa_private_decrypt(&rsactx,
@@ -158,7 +162,7 @@ lws_jwe_auth_and_decrypt_rsa_aes_gcm(struct lws_jwe *jwe)
158162
lws_genrsa_destroy(&rsactx);
159163
if (n < 0) {
160164
lwsl_err("%s: decrypt cek fail: \n", __func__);
161-
return -1;
165+
return n < -1 ? n : -1;
162166
}
163167

164168
n = lws_jwe_auth_and_decrypt_gcm(jwe, enc_cek,

‎lib/media/alsa/CMakeLists.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
if (LWS_WITH_ALSA)
22
set(SRCS alsa.c)
33
add_library(alsa STATIC ${SRCS})
4-
target_include_directories(alsa PRIVATE ${LWS_LIB_BUILD_INC_PATHS})
4+
target_include_directories(alsa PRIVATE ${LWS_LIB_BUILD_INC_PATHS} ${LWS_LIB_BUILD_INC_PATHS_TEMP})
55
target_link_libraries(alsa websockets asound)
66
endif()

‎lib/tls/gnutls/lws-genaes.c‎

Lines changed: 19 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ lws_genaes_create(struct lws_genaes_ctx *ctx, enum enum_aes_operation op,
7070
break;
7171
default:
7272
lwsl_err("%s: unsupported mode %d\n", __func__, mode);
73-
return 1;
73+
return -2;
7474
}
7575

7676
if (alg == GNUTLS_CIPHER_UNKNOWN)
@@ -183,7 +183,11 @@ lws_genaes_crypt(struct lws_genaes_ctx *ctx, const uint8_t *in, size_t len,
183183
}
184184

185185
if (iv_or_nonce_ctr_or_data_unit_16) {
186-
gnutls_cipher_set_iv(ctx->ctx, iv_or_nonce_ctr_or_data_unit_16, 16);
186+
if (ctx->mode != LWS_GAESM_GCM || !ctx->gnutls_gcm_initialized) {
187+
size_t iv_len = (nc_or_iv_off && *nc_or_iv_off) ? *nc_or_iv_off : 16;
188+
gnutls_cipher_set_iv(ctx->ctx, iv_or_nonce_ctr_or_data_unit_16, iv_len);
189+
ctx->gnutls_gcm_initialized = 1;
190+
}
187191
}
188192

189193
if (ctx->op == LWS_GAESO_ENC) {
@@ -218,15 +222,22 @@ lws_genaes_crypt(struct lws_genaes_ctx *ctx, const uint8_t *in, size_t len,
218222
ctx->buf_len += (int)left;
219223
}
220224
} else {
221-
if (gnutls_cipher_encrypt2(ctx->ctx, in, len, out, len) < 0)
222-
return 1;
223-
if (ctx->mode == LWS_GAESM_GCM && stream_block_16) {
224-
gnutls_cipher_tag(ctx->ctx, stream_block_16, (size_t)taglen);
225+
if (!out && ctx->mode == LWS_GAESM_GCM) {
226+
if (gnutls_cipher_add_auth(ctx->ctx, in, len) < 0)
227+
return 1;
228+
} else {
229+
if (gnutls_cipher_encrypt2(ctx->ctx, in, len, out, len) < 0)
230+
return 1;
225231
}
226232
}
227233
} else {
228-
if (gnutls_cipher_decrypt2(ctx->ctx, in, len, out, len) < 0)
229-
return 1;
234+
if (!out && ctx->mode == LWS_GAESM_GCM) {
235+
if (gnutls_cipher_add_auth(ctx->ctx, in, len) < 0)
236+
return 1;
237+
} else {
238+
if (gnutls_cipher_decrypt2(ctx->ctx, in, len, out, len) < 0)
239+
return 1;
240+
}
230241
}
231242

232243
return 0;

‎lib/tls/gnutls/lws-genrsa.c‎

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,11 @@ lws_genrsa_create(struct lws_genrsa_ctx *ctx,
5858
u.size = el[LWS_GENCRYPTO_RSA_KEYEL_QI].len;
5959

6060
if (d.data) {
61+
if (!p.data || !q.data || !e1.data || !e2.data || !u.data) {
62+
lwsl_notice("GnuTLS requires all private key params, skipping\n");
63+
return -2;
64+
}
65+
6166
if (gnutls_privkey_init(&ctx->priv) < 0)
6267
return 1;
6368

@@ -113,12 +118,18 @@ lws_genrsa_public_encrypt(struct lws_genrsa_ctx *ctx, const uint8_t *in,
113118

114119
if (ctx->mode == LGRSAM_PKCS1_OAEP_PSS) {
115120
lwsl_err("%s: GnuTLS does not support RSA OAEP\n", __func__);
116-
return -1;
121+
return -2;
117122
}
118123

119124
n = gnutls_pubkey_encrypt_data(ctx->pub, 0, &v_in, &v_out);
120125

121126
if (n < 0) {
127+
if (
128+
#if defined(GNUTLS_E_UNSUPPORTED_ENCRYPTION_ALGORITHM)
129+
n == GNUTLS_E_UNSUPPORTED_ENCRYPTION_ALGORITHM ||
130+
#endif
131+
0)
132+
return -2;
122133
lwsl_err("%s: gnutls_pubkey_encrypt_data failed: %s\n", __func__, gnutls_strerror(n));
123134
return -1;
124135
}
@@ -142,12 +153,18 @@ lws_genrsa_private_decrypt(struct lws_genrsa_ctx *ctx, const uint8_t *in,
142153

143154
if (ctx->mode == LGRSAM_PKCS1_OAEP_PSS) {
144155
lwsl_err("%s: GnuTLS does not support RSA OAEP\n", __func__);
145-
return -1;
156+
return -2;
146157
}
147158

148159
n = gnutls_privkey_decrypt_data(ctx->priv, 0, &v_in, &v_out);
149160

150161
if (n < 0) {
162+
if (
163+
#if defined(GNUTLS_E_UNSUPPORTED_ENCRYPTION_ALGORITHM)
164+
n == GNUTLS_E_UNSUPPORTED_ENCRYPTION_ALGORITHM ||
165+
#endif
166+
n == GNUTLS_E_DECRYPTION_FAILED)
167+
return -2;
151168
lwsl_err("%s: gnutls_privkey_decrypt_data failed: %s\n", __func__, gnutls_strerror(n));
152169
return -1;
153170
}

‎minimal-examples-lowlevel/api-tests/api-test-gencrypto/lws-genaes.c‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -143,7 +143,12 @@ test_genaes_cfb128(void)
143143
e.buf = (uint8_t *)cfb128_key;
144144
e.len = sizeof(cfb128_key);
145145

146-
if (lws_genaes_create(&ctx, LWS_GAESO_ENC, LWS_GAESM_CFB128, &e, 0, NULL)) {
146+
int n = lws_genaes_create(&ctx, LWS_GAESO_ENC, LWS_GAESM_CFB128, &e, 0, NULL);
147+
if (n) {
148+
if (n == -2) {
149+
lwsl_notice("%s: lws_genaes_create unsupported\n", __func__);
150+
return 0;
151+
}
147152
lwsl_err("%s: lws_genaes_create failed\n", __func__);
148153
return 1;
149154
}

0 commit comments

Comments
 (0)