* [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b
@ 2019-05-16 7:54 Xiaoyu lu
2019-05-16 7:54 ` [PATCH v4 1/7] CryptoPkg/OpensslLib: Modify process_files.pl for upgrading OpenSSL Xiaoyu lu
` (10 more replies)
0 siblings, 11 replies; 39+ messages in thread
From: Xiaoyu lu @ 2019-05-16 7:54 UTC (permalink / raw)
To: devel; +Cc: Laszlo Ersek, Jian J Wang, Ting Ye
This series is also available at:
https://github.com/xiaoyuxlu/edk2/tree/bz_1089_upgrade_to_openssl_1_1_1b_v4
Changes:
(1) CryptoPkgOpensslLib: Modify process_files.pl for upgrading OpenSSL
(2) CryptoPkg/OpensslLib: Exclude unnecessary files in process_files.pl
crypto/store/* are excluded.
crypto/rand/randfile.c is excluded.
(3) CryptoPkg/IntrinsicLib: Fix possible unresolved external symbol issue
(4) CryptoPkg/OpensslLib: Prepare for upgrading OpenSSL
Disable warnings for buiding OpenSSL_1_1_1b
(5) CryptoPkg/OpensslLib: Fix cross-build problem for AARCH64
(6) CryptoPkg: Upgrade OpenSSL to 1.1.1b
The biggest change is use TSC as entropy source
If TSC isn't avaiable, fallback to TimerLib(PerformanceCounter).
(7) CryptoPkg/BaseCryptLib: Make HMAC_CTX size backward compatible
Verification done for this series:
* Https boot in OvmfPkg.
* BaseCrypt Library test. (Ovmf, EmulatorPkg)
Important notice:
Nt32Pkg doesn't support TimerLib
> TimerLib|MdePkg/Library/BaseTimerLibNullTemplate/BaseTimerLibNullTemplate.inf
So it will failed in Nt32Pkg.
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Ting Ye <ting.ye@intel.com>
Laszlo Ersek (1):
CryptoPkg/OpensslLib: Fix cross-build problem for AARCH64
Xiaoyu Lu (6):
CryptoPkg/OpensslLib: Modify process_files.pl for upgrading OpenSSL
CryptoPkg/OpensslLib: Exclude unnecessary files in process_files.pl
CryptoPkg/IntrinsicLib: Fix possible unresolved external symbol issue
CryptoPkg/OpensslLib: Prepare for upgrading OpenSSL
CryptoPkg: Upgrade OpenSSL to 1.1.1b
CryptoPkg/BaseCryptLib: Make HMAC_CTX size backward compatible
CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf | 4 +-
CryptoPkg/Library/OpensslLib/OpensslLib.inf | 76 ++++-
CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 67 ++++-
CryptoPkg/Library/Include/CrtLibSupport.h | 13 +-
CryptoPkg/Library/Include/openssl/opensslconf.h | 54 +++-
CryptoPkg/Library/Include/sys/syscall.h | 11 +
CryptoPkg/Library/OpensslLib/buildinf.h | 2 +
CryptoPkg/Library/OpensslLib/rand_pool_noise.h | 29 ++
CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacMd5.c | 8 +-
.../Library/BaseCryptLib/Hmac/CryptHmacSha1.c | 9 +-
.../Library/BaseCryptLib/Hmac/CryptHmacSha256.c | 8 +-
CryptoPkg/Library/IntrinsicLib/Ia32/MathFtol.c | 22 ++
CryptoPkg/Library/OpensslLib/ossl_store.c | 17 ++
CryptoPkg/Library/OpensslLib/rand_pool.c | 316 +++++++++++++++++++++
CryptoPkg/Library/OpensslLib/rand_pool_noise.c | 29 ++
CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c | 43 +++
CryptoPkg/Library/OpensslLib/openssl | 2 +-
CryptoPkg/Library/OpensslLib/process_files.pl | 11 +-
18 files changed, 669 insertions(+), 52 deletions(-)
create mode 100644 CryptoPkg/Library/Include/sys/syscall.h
create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.h
create mode 100644 CryptoPkg/Library/IntrinsicLib/Ia32/MathFtol.c
create mode 100644 CryptoPkg/Library/OpensslLib/ossl_store.c
create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool.c
create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.c
create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c
--
2.7.4
^ permalink raw reply [flat|nested] 39+ messages in thread* [PATCH v4 1/7] CryptoPkg/OpensslLib: Modify process_files.pl for upgrading OpenSSL 2019-05-16 7:54 [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b Xiaoyu lu @ 2019-05-16 7:54 ` Xiaoyu lu 2019-05-16 7:54 ` [PATCH v4 2/7] CryptoPkg/OpensslLib: Exclude unnecessary files in process_files.pl Xiaoyu lu ` (9 subsequent siblings) 10 siblings, 0 replies; 39+ messages in thread From: Xiaoyu lu @ 2019-05-16 7:54 UTC (permalink / raw) To: devel; +Cc: Laszlo Ersek, Jian J Wang, Ting Ye REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1089 OpenSSL configure mechanism use --with-rand-seed=xxx option to configure random number generation. OpenSSL_1_1_0j(74f2d9c1ec5f5510e1d3da5a9f03c28df0977762) we use default --with-rand-seed=os option to for building it. But OpenSSL_1_1_1b(50eaac9f3337667259de725451f201e784599687) only support seeding NONE for UEFI(rand_unix.c line 93). This OpenSSL change was introduced in commit 8389ec4b4950 ("Add --with-rand-seed", 2017-07-22). So add --with-rand-seed=none to process_files.pl. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Ting Ye <ting.ye@intel.com> Signed-off-by: Xiaoyu Lu <xiaoyux.lu@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> --- CryptoPkg/Library/OpensslLib/process_files.pl | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/CryptoPkg/Library/OpensslLib/process_files.pl b/CryptoPkg/Library/OpensslLib/process_files.pl index f6e1f436419b..6c136cca092a 100755 --- a/CryptoPkg/Library/OpensslLib/process_files.pl +++ b/CryptoPkg/Library/OpensslLib/process_files.pl @@ -90,7 +90,10 @@ BEGIN { "no-threads", "no-ts", "no-ui", - "no-whirlpool" + "no-whirlpool", + # OpenSSL1_1_1b doesn't support default rand-seed-os for UEFI + # UEFI only support --with-rand-seed=none + "--with-rand-seed=none" ) == 0 || die "OpenSSL Configure failed!\n"; -- 2.7.4 ^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PATCH v4 2/7] CryptoPkg/OpensslLib: Exclude unnecessary files in process_files.pl 2019-05-16 7:54 [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b Xiaoyu lu 2019-05-16 7:54 ` [PATCH v4 1/7] CryptoPkg/OpensslLib: Modify process_files.pl for upgrading OpenSSL Xiaoyu lu @ 2019-05-16 7:54 ` Xiaoyu lu 2019-05-16 15:51 ` [edk2-devel] " Laszlo Ersek 2019-05-16 7:54 ` [PATCH v4 3/7] CryptoPkg/IntrinsicLib: Fix possible unresolved external symbol issue Xiaoyu lu ` (8 subsequent siblings) 10 siblings, 1 reply; 39+ messages in thread From: Xiaoyu lu @ 2019-05-16 7:54 UTC (permalink / raw) To: devel; +Cc: Laszlo Ersek, Jian J Wang, Ting Ye REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1089 When running process_files.py to configure OpenSSL, we can exclude some unnecessary files. This can reduce porting time, compiling time and library size. Upstream OpenSSL commit 71a5516dcc8a which was as part of OpenSSL_1_1_1b, Add the STORE module(crypto/store/*). But UEFI don't use them. So exclude these files. Functions in crypto/rand/randfile.c OpenSSL and edk2 don't call them. And it requires more crt runtime support. So exclude it. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Ting Ye <ting.ye@intel.com> Signed-off-by: Xiaoyu Lu <xiaoyux.lu@intel.com> --- CryptoPkg/Library/OpensslLib/process_files.pl | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/CryptoPkg/Library/OpensslLib/process_files.pl b/CryptoPkg/Library/OpensslLib/process_files.pl index 6c136cca092a..e277108f0734 100755 --- a/CryptoPkg/Library/OpensslLib/process_files.pl +++ b/CryptoPkg/Library/OpensslLib/process_files.pl @@ -127,6 +127,12 @@ foreach my $product ((@{$unified_info{libraries}}, foreach my $s (@{$unified_info{sources}->{$o}}) { next if ($unified_info{generate}->{$s}); next if $s =~ "crypto/bio/b_print.c"; + + # No need to add unused files in UEFI. + # So it can reduce porting time, compile time, library size. + next if $s =~ "crypto/rand/randfile.c"; + next if $s =~ "crypto/store/"; + if ($product =~ "libssl") { push @sslfilelist, ' $(OPENSSL_PATH)/' . $s . "\r\n"; next; -- 2.7.4 ^ permalink raw reply related [flat|nested] 39+ messages in thread
* Re: [edk2-devel] [PATCH v4 2/7] CryptoPkg/OpensslLib: Exclude unnecessary files in process_files.pl 2019-05-16 7:54 ` [PATCH v4 2/7] CryptoPkg/OpensslLib: Exclude unnecessary files in process_files.pl Xiaoyu lu @ 2019-05-16 15:51 ` Laszlo Ersek 0 siblings, 0 replies; 39+ messages in thread From: Laszlo Ersek @ 2019-05-16 15:51 UTC (permalink / raw) To: devel, xiaoyux.lu; +Cc: Jian J Wang, Ting Ye On 05/16/19 09:54, Xiaoyu lu wrote: > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1089 > > When running process_files.py to configure OpenSSL, we can exclude > some unnecessary files. This can reduce porting time, compiling > time and library size. > > Upstream OpenSSL commit 71a5516dcc8a which was as part of > OpenSSL_1_1_1b, Add the STORE module(crypto/store/*). > But UEFI don't use them. So exclude these files. > > Functions in crypto/rand/randfile.c OpenSSL and edk2 don't > call them. And it requires more crt runtime support. > So exclude it. > > Cc: Jian J Wang <jian.j.wang@intel.com> > Cc: Ting Ye <ting.ye@intel.com> > Signed-off-by: Xiaoyu Lu <xiaoyux.lu@intel.com> > --- > CryptoPkg/Library/OpensslLib/process_files.pl | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/CryptoPkg/Library/OpensslLib/process_files.pl b/CryptoPkg/Library/OpensslLib/process_files.pl > index 6c136cca092a..e277108f0734 100755 > --- a/CryptoPkg/Library/OpensslLib/process_files.pl > +++ b/CryptoPkg/Library/OpensslLib/process_files.pl > @@ -127,6 +127,12 @@ foreach my $product ((@{$unified_info{libraries}}, > foreach my $s (@{$unified_info{sources}->{$o}}) { > next if ($unified_info{generate}->{$s}); > next if $s =~ "crypto/bio/b_print.c"; > + > + # No need to add unused files in UEFI. > + # So it can reduce porting time, compile time, library size. > + next if $s =~ "crypto/rand/randfile.c"; > + next if $s =~ "crypto/store/"; > + > if ($product =~ "libssl") { > push @sslfilelist, ' $(OPENSSL_PATH)/' . $s . "\r\n"; > next; > Reviewed-by: Laszlo Ersek <lersek@redhat.com> ^ permalink raw reply [flat|nested] 39+ messages in thread
* [PATCH v4 3/7] CryptoPkg/IntrinsicLib: Fix possible unresolved external symbol issue 2019-05-16 7:54 [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b Xiaoyu lu 2019-05-16 7:54 ` [PATCH v4 1/7] CryptoPkg/OpensslLib: Modify process_files.pl for upgrading OpenSSL Xiaoyu lu 2019-05-16 7:54 ` [PATCH v4 2/7] CryptoPkg/OpensslLib: Exclude unnecessary files in process_files.pl Xiaoyu lu @ 2019-05-16 7:54 ` Xiaoyu lu 2019-05-16 7:54 ` [PATCH v4 4/7] CryptoPkg/OpensslLib: Prepare for upgrading OpenSSL Xiaoyu lu ` (7 subsequent siblings) 10 siblings, 0 replies; 39+ messages in thread From: Xiaoyu lu @ 2019-05-16 7:54 UTC (permalink / raw) To: devel; +Cc: Laszlo Ersek, Jian J Wang, Ting Ye REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1089 This is for the upcoming upgrade to OpenSSL_1_1_1b Compiler optimization(Visual Studio) may automatically use _ftol2 instead of some type conversion. For example: OpensslLib.lib(drbg_lib.obj) : error LNK2001: unresolved external symbol __ftol2 This patch add _ftol2 function for the compiler intrinsic. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Ting Ye <ting.ye@intel.com> Signed-off-by: Xiaoyu Lu <xiaoyux.lu@intel.com> --- CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf | 4 +++- CryptoPkg/Library/IntrinsicLib/Ia32/MathFtol.c | 22 ++++++++++++++++++++++ 2 files changed, 25 insertions(+), 1 deletion(-) create mode 100644 CryptoPkg/Library/IntrinsicLib/Ia32/MathFtol.c diff --git a/CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf b/CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf index 5a20967b6cb8..fcbb93316cf7 100644 --- a/CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf +++ b/CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf @@ -1,7 +1,7 @@ ## @file # Intrinsic Routines Wrapper Library Instance. # -# Copyright (c) 2010 - 2018, Intel Corporation. All rights reserved.<BR> +# Copyright (c) 2010 - 2019, Intel Corporation. All rights reserved.<BR> # SPDX-License-Identifier: BSD-2-Clause-Patent # ## @@ -29,9 +29,11 @@ [Sources.IA32] Ia32/MathLShiftS64.c | MSFT Ia32/MathRShiftU64.c | MSFT + Ia32/MathFtol.c | MSFT Ia32/MathLShiftS64.c | INTEL Ia32/MathRShiftU64.c | INTEL + Ia32/MathFtol.c | INTEL Ia32/MathLShiftS64.nasm | GCC Ia32/MathRShiftU64.nasm | GCC diff --git a/CryptoPkg/Library/IntrinsicLib/Ia32/MathFtol.c b/CryptoPkg/Library/IntrinsicLib/Ia32/MathFtol.c new file mode 100644 index 000000000000..147a19a4adb0 --- /dev/null +++ b/CryptoPkg/Library/IntrinsicLib/Ia32/MathFtol.c @@ -0,0 +1,22 @@ +/** @file + 64-bit Math Worker Function. + The 32-bit versions of C compiler generate calls to library routines + to handle 64-bit math. These functions use non-standard calling conventions. + +Copyright (c) 2019, Intel Corporation. All rights reserved.<BR> +SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +/* + * Floating point to integer conversion. + */ +__declspec(naked) void _ftol2 (void) +{ + _asm { + fistp qword ptr [esp-8] + mov edx, [esp-4] + mov eax, [esp-8] + ret + } +} -- 2.7.4 ^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PATCH v4 4/7] CryptoPkg/OpensslLib: Prepare for upgrading OpenSSL 2019-05-16 7:54 [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b Xiaoyu lu ` (2 preceding siblings ...) 2019-05-16 7:54 ` [PATCH v4 3/7] CryptoPkg/IntrinsicLib: Fix possible unresolved external symbol issue Xiaoyu lu @ 2019-05-16 7:54 ` Xiaoyu lu 2019-05-16 7:54 ` [PATCH v4 5/7] CryptoPkg/OpensslLib: Fix cross-build problem for AARCH64 Xiaoyu lu ` (6 subsequent siblings) 10 siblings, 0 replies; 39+ messages in thread From: Xiaoyu lu @ 2019-05-16 7:54 UTC (permalink / raw) To: devel; +Cc: Laszlo Ersek, Jian J Wang, Ting Ye REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1089 Disable warning for building OpenSSL_1_1_1b add /wd4132 /wd4700 /wd4310 for Visual Studio in OpensslLib[Crypto].inf add -Wno-error=unused-but-set-variable for GCC in OpensslLib[Crypto].inf Although this option is set in some build environments by default. But this is only for OpenSSL compilation, no matter how the default options change. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Ting Ye <ting.ye@intel.com> Signed-off-by: Xiaoyu Lu <xiaoyux.lu@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> --- CryptoPkg/Library/OpensslLib/OpensslLib.inf | 16 ++++++++++------ CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 16 ++++++++++------ 2 files changed, 20 insertions(+), 12 deletions(-) diff --git a/CryptoPkg/Library/OpensslLib/OpensslLib.inf b/CryptoPkg/Library/OpensslLib/OpensslLib.inf index 530ac5f11096..f4d7772c068c 100644 --- a/CryptoPkg/Library/OpensslLib/OpensslLib.inf +++ b/CryptoPkg/Library/OpensslLib/OpensslLib.inf @@ -530,17 +530,20 @@ [BuildOptions] # Disables the following Visual Studio compiler warnings brought by openssl source, # so we do not break the build with /WX option: # C4090: 'function' : different 'const' qualifiers + # C4132: 'object' : const object should be initialized (tls13_enc.c) # C4244: conversion from type1 to type2, possible loss of data # C4245: conversion from type1 to type2, signed/unsigned mismatch # C4267: conversion from size_t to type, possible loss of data # C4306: 'identifier' : conversion from 'type1' to 'type2' of greater size + # C4310: cast truncates constant value # C4389: 'operator' : signed/unsigned mismatch (xxxx) + # C4700: uninitialized local variable 'name' used. (conf_sap.c(71)) # C4702: unreachable code # C4706: assignment within conditional expression # C4819: The file contains a character that cannot be represented in the current code page # - MSFT:*_*_IA32_CC_FLAGS = -U_WIN32 -U_WIN64 -U_MSC_VER $(OPENSSL_FLAGS) /wd4090 /wd4244 /wd4245 /wd4267 /wd4389 /wd4702 /wd4706 /wd4819 - MSFT:*_*_X64_CC_FLAGS = -U_WIN32 -U_WIN64 -U_MSC_VER $(OPENSSL_FLAGS) /wd4090 /wd4244 /wd4245 /wd4267 /wd4306 /wd4389 /wd4702 /wd4706 /wd4819 + MSFT:*_*_IA32_CC_FLAGS = -U_WIN32 -U_WIN64 -U_MSC_VER $(OPENSSL_FLAGS) /wd4090 /wd4132 /wd4244 /wd4245 /wd4267 /wd4310 /wd4389 /wd4700 /wd4702 /wd4706 /wd4819 + MSFT:*_*_X64_CC_FLAGS = -U_WIN32 -U_WIN64 -U_MSC_VER $(OPENSSL_FLAGS) /wd4090 /wd4132 /wd4244 /wd4245 /wd4267 /wd4306 /wd4310 /wd4700 /wd4389 /wd4702 /wd4706 /wd4819 INTEL:*_*_IA32_CC_FLAGS = -U_WIN32 -U_WIN64 -U_MSC_VER -U__ICC $(OPENSSL_FLAGS) /w INTEL:*_*_X64_CC_FLAGS = -U_WIN32 -U_WIN64 -U_MSC_VER -U__ICC $(OPENSSL_FLAGS) /w @@ -550,11 +553,12 @@ [BuildOptions] # -Werror=maybe-uninitialized: there exist some other paths for which the variable is not initialized. # -Werror=format: Check calls to printf and scanf, etc., to make sure that the arguments supplied have # types appropriate to the format string specified. + # -Werror=unused-but-set-variable: Warn whenever a local variable is assigned to, but otherwise unused (aside from its declaration). # - GCC:*_*_IA32_CC_FLAGS = -U_WIN32 -U_WIN64 $(OPENSSL_FLAGS) -Wno-error=maybe-uninitialized - GCC:*_*_X64_CC_FLAGS = -U_WIN32 -U_WIN64 $(OPENSSL_FLAGS) -Wno-error=maybe-uninitialized -Wno-error=format -Wno-format -DNO_MSABI_VA_FUNCS - GCC:*_*_ARM_CC_FLAGS = $(OPENSSL_FLAGS) -Wno-error=maybe-uninitialized - GCC:*_*_AARCH64_CC_FLAGS = $(OPENSSL_FLAGS) -Wno-error=maybe-uninitialized -Wno-format + GCC:*_*_IA32_CC_FLAGS = -U_WIN32 -U_WIN64 $(OPENSSL_FLAGS) -Wno-error=maybe-uninitialized -Wno-error=unused-but-set-variable + GCC:*_*_X64_CC_FLAGS = -U_WIN32 -U_WIN64 $(OPENSSL_FLAGS) -Wno-error=maybe-uninitialized -Wno-error=format -Wno-format -Wno-error=unused-but-set-variable -DNO_MSABI_VA_FUNCS + GCC:*_*_ARM_CC_FLAGS = $(OPENSSL_FLAGS) -Wno-error=maybe-uninitialized -Wno-error=unused-but-set-variable + GCC:*_*_AARCH64_CC_FLAGS = $(OPENSSL_FLAGS) -Wno-error=maybe-uninitialized -Wno-format -Wno-error=unused-but-set-variable # suppress the following warnings in openssl so we don't break the build with warnings-as-errors: # 1295: Deprecated declaration <entity> - give arg types diff --git a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf index 231010098851..fd12d112edb2 100644 --- a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf +++ b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf @@ -491,17 +491,20 @@ [BuildOptions] # Disables the following Visual Studio compiler warnings brought by openssl source, # so we do not break the build with /WX option: # C4090: 'function' : different 'const' qualifiers + # C4132: 'object' : const object should be initialized (tls13_enc.c) # C4244: conversion from type1 to type2, possible loss of data # C4245: conversion from type1 to type2, signed/unsigned mismatch # C4267: conversion from size_t to type, possible loss of data # C4306: 'identifier' : conversion from 'type1' to 'type2' of greater size + # C4310: cast truncates constant value # C4389: 'operator' : signed/unsigned mismatch (xxxx) + # C4700: uninitialized local variable 'name' used. (conf_sap.c(71)) # C4702: unreachable code # C4706: assignment within conditional expression # C4819: The file contains a character that cannot be represented in the current code page # - MSFT:*_*_IA32_CC_FLAGS = -U_WIN32 -U_WIN64 -U_MSC_VER $(OPENSSL_FLAGS) /wd4090 /wd4244 /wd4245 /wd4267 /wd4389 /wd4702 /wd4706 /wd4819 - MSFT:*_*_X64_CC_FLAGS = -U_WIN32 -U_WIN64 -U_MSC_VER $(OPENSSL_FLAGS) /wd4090 /wd4244 /wd4245 /wd4267 /wd4306 /wd4389 /wd4702 /wd4706 /wd4819 + MSFT:*_*_IA32_CC_FLAGS = -U_WIN32 -U_WIN64 -U_MSC_VER $(OPENSSL_FLAGS) /wd4090 /wd4132 /wd4244 /wd4245 /wd4267 /wd4310 /wd4389 /wd4700 /wd4702 /wd4706 /wd4819 + MSFT:*_*_X64_CC_FLAGS = -U_WIN32 -U_WIN64 -U_MSC_VER $(OPENSSL_FLAGS) /wd4090 /wd4132 /wd4244 /wd4245 /wd4267 /wd4306 /wd4310 /wd4700 /wd4389 /wd4702 /wd4706 /wd4819 INTEL:*_*_IA32_CC_FLAGS = -U_WIN32 -U_WIN64 -U_MSC_VER -U__ICC $(OPENSSL_FLAGS) /w INTEL:*_*_X64_CC_FLAGS = -U_WIN32 -U_WIN64 -U_MSC_VER -U__ICC $(OPENSSL_FLAGS) /w @@ -511,11 +514,12 @@ [BuildOptions] # -Werror=maybe-uninitialized: there exist some other paths for which the variable is not initialized. # -Werror=format: Check calls to printf and scanf, etc., to make sure that the arguments supplied have # types appropriate to the format string specified. + # -Werror=unused-but-set-variable: Warn whenever a local variable is assigned to, but otherwise unused (aside from its declaration). # - GCC:*_*_IA32_CC_FLAGS = -U_WIN32 -U_WIN64 $(OPENSSL_FLAGS) -Wno-error=maybe-uninitialized - GCC:*_*_X64_CC_FLAGS = -U_WIN32 -U_WIN64 $(OPENSSL_FLAGS) -Wno-error=maybe-uninitialized -Wno-error=format -Wno-format -DNO_MSABI_VA_FUNCS - GCC:*_*_ARM_CC_FLAGS = $(OPENSSL_FLAGS) -Wno-error=maybe-uninitialized - GCC:*_*_AARCH64_CC_FLAGS = $(OPENSSL_FLAGS) -Wno-error=maybe-uninitialized -Wno-format + GCC:*_*_IA32_CC_FLAGS = -U_WIN32 -U_WIN64 $(OPENSSL_FLAGS) -Wno-error=maybe-uninitialized -Wno-error=unused-but-set-variable + GCC:*_*_X64_CC_FLAGS = -U_WIN32 -U_WIN64 $(OPENSSL_FLAGS) -Wno-error=maybe-uninitialized -Wno-error=format -Wno-format -Wno-error=unused-but-set-variable -DNO_MSABI_VA_FUNCS + GCC:*_*_ARM_CC_FLAGS = $(OPENSSL_FLAGS) -Wno-error=maybe-uninitialized -Wno-error=unused-but-set-variable + GCC:*_*_AARCH64_CC_FLAGS = $(OPENSSL_FLAGS) -Wno-error=maybe-uninitialized -Wno-format -Wno-error=unused-but-set-variable # suppress the following warnings in openssl so we don't break the build with warnings-as-errors: # 1295: Deprecated declaration <entity> - give arg types -- 2.7.4 ^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PATCH v4 5/7] CryptoPkg/OpensslLib: Fix cross-build problem for AARCH64 2019-05-16 7:54 [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b Xiaoyu lu ` (3 preceding siblings ...) 2019-05-16 7:54 ` [PATCH v4 4/7] CryptoPkg/OpensslLib: Prepare for upgrading OpenSSL Xiaoyu lu @ 2019-05-16 7:54 ` Xiaoyu lu 2019-05-16 15:58 ` [edk2-devel] " Laszlo Ersek 2019-05-16 7:54 ` [PATCH v4 6/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b Xiaoyu lu ` (5 subsequent siblings) 10 siblings, 1 reply; 39+ messages in thread From: Xiaoyu lu @ 2019-05-16 7:54 UTC (permalink / raw) To: devel; +Cc: Laszlo Ersek, Jian J Wang, Ting Ye From: Laszlo Ersek <lersek@redhat.com> BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=1089 Thanks Laszlo Ersek <lersek@redhat.com>. Ref: https://edk2.groups.io/g/devel/message/40375 Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Ting Ye <ting.ye@intel.com> Signed-off-by: Xiaoyu Lu <xiaoyux.lu@intel.com> --- CryptoPkg/Library/Include/sys/syscall.h | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 CryptoPkg/Library/Include/sys/syscall.h diff --git a/CryptoPkg/Library/Include/sys/syscall.h b/CryptoPkg/Library/Include/sys/syscall.h new file mode 100644 index 000000000000..ca80745e4650 --- /dev/null +++ b/CryptoPkg/Library/Include/sys/syscall.h @@ -0,0 +1,11 @@ +/** @file + Include file to support building the third-party cryptographic library. + +Copyright (c) 2010 - 2017, Intel Corporation. All rights +reserved.<BR> Copyright (c) 2019, Red Hat, Inc. +SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#include <CrtLibSupport.h> + -- 2.7.4 ^ permalink raw reply related [flat|nested] 39+ messages in thread
* Re: [edk2-devel] [PATCH v4 5/7] CryptoPkg/OpensslLib: Fix cross-build problem for AARCH64 2019-05-16 7:54 ` [PATCH v4 5/7] CryptoPkg/OpensslLib: Fix cross-build problem for AARCH64 Xiaoyu lu @ 2019-05-16 15:58 ` Laszlo Ersek 0 siblings, 0 replies; 39+ messages in thread From: Laszlo Ersek @ 2019-05-16 15:58 UTC (permalink / raw) To: devel, xiaoyux.lu, Jian J Wang; +Cc: Ting Ye Jian, On 05/16/19 09:54, Xiaoyu lu wrote: > From: Laszlo Ersek <lersek@redhat.com> > > BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=1089 > > Thanks Laszlo Ersek <lersek@redhat.com>. > Ref: https://edk2.groups.io/g/devel/message/40375 > > Cc: Jian J Wang <jian.j.wang@intel.com> > Cc: Ting Ye <ting.ye@intel.com> > Signed-off-by: Xiaoyu Lu <xiaoyux.lu@intel.com> > --- > CryptoPkg/Library/Include/sys/syscall.h | 11 +++++++++++ > 1 file changed, 11 insertions(+) > create mode 100644 CryptoPkg/Library/Include/sys/syscall.h > > diff --git a/CryptoPkg/Library/Include/sys/syscall.h b/CryptoPkg/Library/Include/sys/syscall.h > new file mode 100644 > index 000000000000..ca80745e4650 > --- /dev/null > +++ b/CryptoPkg/Library/Include/sys/syscall.h > @@ -0,0 +1,11 @@ > +/** @file > + Include file to support building the third-party cryptographic library. > + > +Copyright (c) 2010 - 2017, Intel Corporation. All rights > +reserved.<BR> Copyright (c) 2019, Red Hat, Inc. Before you push this patch, please make sure that the Red Hat copyright notice starts on a new line. I think the usual format is: Copyright (c) 2010 - 2017, Intel Corporation. All rights reserved.<BR> Copyright (c) 2019, Red Hat, Inc. with that: Reviewed-by: Laszlo Ersek <lersek@redhat.com> Thanks Laszlo > +SPDX-License-Identifier: BSD-2-Clause-Patent > + > +**/ > + > +#include <CrtLibSupport.h> > + > ^ permalink raw reply [flat|nested] 39+ messages in thread
* [PATCH v4 6/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b 2019-05-16 7:54 [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b Xiaoyu lu ` (4 preceding siblings ...) 2019-05-16 7:54 ` [PATCH v4 5/7] CryptoPkg/OpensslLib: Fix cross-build problem for AARCH64 Xiaoyu lu @ 2019-05-16 7:54 ` Xiaoyu lu 2019-05-16 16:31 ` [edk2-devel] " Laszlo Ersek 2019-05-16 7:54 ` [PATCH v4 7/7] CryptoPkg/BaseCryptLib: Make HMAC_CTX size backward compatible Xiaoyu lu ` (4 subsequent siblings) 10 siblings, 1 reply; 39+ messages in thread From: Xiaoyu lu @ 2019-05-16 7:54 UTC (permalink / raw) To: devel; +Cc: Laszlo Ersek, Jian J Wang, Ting Ye REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1089 * Update OpenSSL submodule to OpenSSL_1_1_1b OpenSSL_1_1_1b(50eaac9f3337667259de725451f201e784599687) * Run process_files.pl script to regenerate OpensslLib[Crypto].inf and opensslconf.h * Remove -DNO_SYSLOG from OPENSSL_FLAGS in OpensslLib[Crypto].inf, due to upstream OpenSSL commit cff55b90e95e("Cleaning UEFI Build with additional OPENSSL_SYS_UEFI flags", 2017-03-29), which was first released as part of OpenSSL_1_1_1. * Starting with OpenSSL commit 8a8d9e1905(first release in OpenSSL_1_1_1), the OpenSSL_version() function can no longer return a pointer to the string literal "compiler: information not available", in the case CFLAGS macro is not defined. Instead, the function now has a hard dependency on the global variable 'compiler_flags'. This variable is normally placed by "util/mkbuildinf.pl" into "buildinf.h". In edk2 we don't run that script whenever we build OpenSSL, therefore we must provide our own dummy 'compiler_flags'. * From OpenSSL_1_1_0i(97c0959f27b294fe1eb10b547145ebef2524b896) to OpenSSL_1_1_1b(50eaac9f3337667259de725451f201e784599687), OpenSSL updated DRBG / RAND to request nonce and additional low entropy randomness from system(line 229 openssl/CHANGES). Since OpenSSL_1_1_1b doesn't fully implement rand pool functions for UEFI. We must provide a method to implenet these method. TSC is used as first entropy source if it's availabe otherwise fallback to TimerLib. But we are not sure the amount of randomness they provide. If you really care about the security, one choice is overrided it with hardware generator. Add rand_pool.c to implement these functions required by OpenSSL rand_pool_acquire_entropy rand_pool_add_nonce_data rand_pool_add_additional_data rand_pool_init rand_pool_cleanup rand_pool_keep_random_devices_open And add rand_pool_noise.* for getting entropy noise from different architecture. * We don't need ossl_store functions. We exclude relative files through process_files.pl. And ossl_store_cleanup_int was first added in crypto/init.c OpenSSL_1_1_1(71a5516d). So add a new file(ossl_store.c) to implement ossl_store_cleanup_int function. * BUFSIZ is used by crypto/evp/evp_key.c(OpenSSL_1_1_1b) And it is declared in stdio.h. So add it to CrtLibSupport.h. Here's a discussion about this. Ref: https://github.com/openssl/openssl/issues/8904 Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Ting Ye <ting.ye@intel.com> Signed-off-by: Xiaoyu Lu <xiaoyux.lu@intel.com> --- CryptoPkg/Library/OpensslLib/OpensslLib.inf | 60 +++- CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 51 +++- CryptoPkg/Library/Include/CrtLibSupport.h | 13 +- CryptoPkg/Library/Include/openssl/opensslconf.h | 54 +++- CryptoPkg/Library/OpensslLib/buildinf.h | 2 + CryptoPkg/Library/OpensslLib/rand_pool_noise.h | 29 ++ CryptoPkg/Library/OpensslLib/ossl_store.c | 17 ++ CryptoPkg/Library/OpensslLib/rand_pool.c | 316 +++++++++++++++++++++ CryptoPkg/Library/OpensslLib/rand_pool_noise.c | 29 ++ CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c | 43 +++ CryptoPkg/Library/OpensslLib/openssl | 2 +- 11 files changed, 584 insertions(+), 32 deletions(-) create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.h create mode 100644 CryptoPkg/Library/OpensslLib/ossl_store.c create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool.c create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.c create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c diff --git a/CryptoPkg/Library/OpensslLib/OpensslLib.inf b/CryptoPkg/Library/OpensslLib/OpensslLib.inf index f4d7772c068c..62dd61969cb0 100644 --- a/CryptoPkg/Library/OpensslLib/OpensslLib.inf +++ b/CryptoPkg/Library/OpensslLib/OpensslLib.inf @@ -1,7 +1,7 @@ ## @file # This module provides OpenSSL Library implementation. # -# Copyright (c) 2010 - 2018, Intel Corporation. All rights reserved.<BR> +# Copyright (c) 2010 - 2019, Intel Corporation. All rights reserved.<BR> # SPDX-License-Identifier: BSD-2-Clause-Patent # ## @@ -15,7 +15,7 @@ [Defines] VERSION_STRING = 1.0 LIBRARY_CLASS = OpensslLib DEFINE OPENSSL_PATH = openssl - DEFINE OPENSSL_FLAGS = -DL_ENDIAN -DOPENSSL_SMALL_FOOTPRINT -D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECATE -DNO_SYSLOG + DEFINE OPENSSL_FLAGS = -DL_ENDIAN -DOPENSSL_SMALL_FOOTPRINT -D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECATE # # VALID_ARCHITECTURES = IA32 X64 ARM AARCH64 @@ -32,6 +32,7 @@ [Sources] $(OPENSSL_PATH)/crypto/aes/aes_misc.c $(OPENSSL_PATH)/crypto/aes/aes_ofb.c $(OPENSSL_PATH)/crypto/aes/aes_wrap.c + $(OPENSSL_PATH)/crypto/aria/aria.c $(OPENSSL_PATH)/crypto/asn1/a_bitstr.c $(OPENSSL_PATH)/crypto/asn1/a_d2i_fp.c $(OPENSSL_PATH)/crypto/asn1/a_digest.c @@ -54,6 +55,7 @@ [Sources] $(OPENSSL_PATH)/crypto/asn1/ameth_lib.c $(OPENSSL_PATH)/crypto/asn1/asn1_err.c $(OPENSSL_PATH)/crypto/asn1/asn1_gen.c + $(OPENSSL_PATH)/crypto/asn1/asn1_item_list.c $(OPENSSL_PATH)/crypto/asn1/asn1_lib.c $(OPENSSL_PATH)/crypto/asn1/asn1_par.c $(OPENSSL_PATH)/crypto/asn1/asn_mime.c @@ -172,6 +174,7 @@ [Sources] $(OPENSSL_PATH)/crypto/conf/conf_ssl.c $(OPENSSL_PATH)/crypto/cpt_err.c $(OPENSSL_PATH)/crypto/cryptlib.c + $(OPENSSL_PATH)/crypto/ctype.c $(OPENSSL_PATH)/crypto/cversion.c $(OPENSSL_PATH)/crypto/des/cbc_cksm.c $(OPENSSL_PATH)/crypto/des/cbc_enc.c @@ -189,7 +192,6 @@ [Sources] $(OPENSSL_PATH)/crypto/des/pcbc_enc.c $(OPENSSL_PATH)/crypto/des/qud_cksm.c $(OPENSSL_PATH)/crypto/des/rand_key.c - $(OPENSSL_PATH)/crypto/des/rpc_enc.c $(OPENSSL_PATH)/crypto/des/set_key.c $(OPENSSL_PATH)/crypto/des/str2key.c $(OPENSSL_PATH)/crypto/des/xcbc_enc.c @@ -206,6 +208,7 @@ [Sources] $(OPENSSL_PATH)/crypto/dh/dh_pmeth.c $(OPENSSL_PATH)/crypto/dh/dh_prn.c $(OPENSSL_PATH)/crypto/dh/dh_rfc5114.c + $(OPENSSL_PATH)/crypto/dh/dh_rfc7919.c $(OPENSSL_PATH)/crypto/dso/dso_dl.c $(OPENSSL_PATH)/crypto/dso/dso_dlfcn.c $(OPENSSL_PATH)/crypto/dso/dso_err.c @@ -228,6 +231,7 @@ [Sources] $(OPENSSL_PATH)/crypto/evp/e_aes.c $(OPENSSL_PATH)/crypto/evp/e_aes_cbc_hmac_sha1.c $(OPENSSL_PATH)/crypto/evp/e_aes_cbc_hmac_sha256.c + $(OPENSSL_PATH)/crypto/evp/e_aria.c $(OPENSSL_PATH)/crypto/evp/e_bf.c $(OPENSSL_PATH)/crypto/evp/e_camellia.c $(OPENSSL_PATH)/crypto/evp/e_cast.c @@ -242,6 +246,7 @@ [Sources] $(OPENSSL_PATH)/crypto/evp/e_rc4_hmac_md5.c $(OPENSSL_PATH)/crypto/evp/e_rc5.c $(OPENSSL_PATH)/crypto/evp/e_seed.c + $(OPENSSL_PATH)/crypto/evp/e_sm4.c $(OPENSSL_PATH)/crypto/evp/e_xcbc_d.c $(OPENSSL_PATH)/crypto/evp/encode.c $(OPENSSL_PATH)/crypto/evp/evp_cnf.c @@ -259,6 +264,7 @@ [Sources] $(OPENSSL_PATH)/crypto/evp/m_null.c $(OPENSSL_PATH)/crypto/evp/m_ripemd.c $(OPENSSL_PATH)/crypto/evp/m_sha1.c + $(OPENSSL_PATH)/crypto/evp/m_sha3.c $(OPENSSL_PATH)/crypto/evp/m_sigver.c $(OPENSSL_PATH)/crypto/evp/m_wp.c $(OPENSSL_PATH)/crypto/evp/names.c @@ -271,10 +277,10 @@ [Sources] $(OPENSSL_PATH)/crypto/evp/p_seal.c $(OPENSSL_PATH)/crypto/evp/p_sign.c $(OPENSSL_PATH)/crypto/evp/p_verify.c + $(OPENSSL_PATH)/crypto/evp/pbe_scrypt.c $(OPENSSL_PATH)/crypto/evp/pmeth_fn.c $(OPENSSL_PATH)/crypto/evp/pmeth_gn.c $(OPENSSL_PATH)/crypto/evp/pmeth_lib.c - $(OPENSSL_PATH)/crypto/evp/scrypt.c $(OPENSSL_PATH)/crypto/ex_data.c $(OPENSSL_PATH)/crypto/getenv.c $(OPENSSL_PATH)/crypto/hmac/hm_ameth.c @@ -283,6 +289,7 @@ [Sources] $(OPENSSL_PATH)/crypto/init.c $(OPENSSL_PATH)/crypto/kdf/hkdf.c $(OPENSSL_PATH)/crypto/kdf/kdf_err.c + $(OPENSSL_PATH)/crypto/kdf/scrypt.c $(OPENSSL_PATH)/crypto/kdf/tls1_prf.c $(OPENSSL_PATH)/crypto/lhash/lh_stats.c $(OPENSSL_PATH)/crypto/lhash/lhash.c @@ -360,14 +367,14 @@ [Sources] $(OPENSSL_PATH)/crypto/pkcs7/pk7_mime.c $(OPENSSL_PATH)/crypto/pkcs7/pk7_smime.c $(OPENSSL_PATH)/crypto/pkcs7/pkcs7err.c - $(OPENSSL_PATH)/crypto/rand/md_rand.c + $(OPENSSL_PATH)/crypto/rand/drbg_ctr.c + $(OPENSSL_PATH)/crypto/rand/drbg_lib.c $(OPENSSL_PATH)/crypto/rand/rand_egd.c $(OPENSSL_PATH)/crypto/rand/rand_err.c $(OPENSSL_PATH)/crypto/rand/rand_lib.c $(OPENSSL_PATH)/crypto/rand/rand_unix.c $(OPENSSL_PATH)/crypto/rand/rand_vms.c $(OPENSSL_PATH)/crypto/rand/rand_win.c - $(OPENSSL_PATH)/crypto/rand/randfile.c $(OPENSSL_PATH)/crypto/rc4/rc4_enc.c $(OPENSSL_PATH)/crypto/rc4/rc4_skey.c $(OPENSSL_PATH)/crypto/rsa/rsa_ameth.c @@ -379,8 +386,8 @@ [Sources] $(OPENSSL_PATH)/crypto/rsa/rsa_gen.c $(OPENSSL_PATH)/crypto/rsa/rsa_lib.c $(OPENSSL_PATH)/crypto/rsa/rsa_meth.c + $(OPENSSL_PATH)/crypto/rsa/rsa_mp.c $(OPENSSL_PATH)/crypto/rsa/rsa_none.c - $(OPENSSL_PATH)/crypto/rsa/rsa_null.c $(OPENSSL_PATH)/crypto/rsa/rsa_oaep.c $(OPENSSL_PATH)/crypto/rsa/rsa_ossl.c $(OPENSSL_PATH)/crypto/rsa/rsa_pk1.c @@ -392,15 +399,27 @@ [Sources] $(OPENSSL_PATH)/crypto/rsa/rsa_ssl.c $(OPENSSL_PATH)/crypto/rsa/rsa_x931.c $(OPENSSL_PATH)/crypto/rsa/rsa_x931g.c + $(OPENSSL_PATH)/crypto/sha/keccak1600.c $(OPENSSL_PATH)/crypto/sha/sha1_one.c $(OPENSSL_PATH)/crypto/sha/sha1dgst.c $(OPENSSL_PATH)/crypto/sha/sha256.c $(OPENSSL_PATH)/crypto/sha/sha512.c + $(OPENSSL_PATH)/crypto/siphash/siphash.c + $(OPENSSL_PATH)/crypto/siphash/siphash_ameth.c + $(OPENSSL_PATH)/crypto/siphash/siphash_pmeth.c + $(OPENSSL_PATH)/crypto/sm3/m_sm3.c + $(OPENSSL_PATH)/crypto/sm3/sm3.c + $(OPENSSL_PATH)/crypto/sm4/sm4.c $(OPENSSL_PATH)/crypto/stack/stack.c $(OPENSSL_PATH)/crypto/threads_none.c $(OPENSSL_PATH)/crypto/threads_pthread.c $(OPENSSL_PATH)/crypto/threads_win.c $(OPENSSL_PATH)/crypto/txt_db/txt_db.c + $(OPENSSL_PATH)/crypto/ui/ui_err.c + $(OPENSSL_PATH)/crypto/ui/ui_lib.c + $(OPENSSL_PATH)/crypto/ui/ui_null.c + $(OPENSSL_PATH)/crypto/ui/ui_openssl.c + $(OPENSSL_PATH)/crypto/ui/ui_util.c $(OPENSSL_PATH)/crypto/uid.c $(OPENSSL_PATH)/crypto/x509/by_dir.c $(OPENSSL_PATH)/crypto/x509/by_file.c @@ -445,6 +464,7 @@ [Sources] $(OPENSSL_PATH)/crypto/x509v3/pcy_node.c $(OPENSSL_PATH)/crypto/x509v3/pcy_tree.c $(OPENSSL_PATH)/crypto/x509v3/v3_addr.c + $(OPENSSL_PATH)/crypto/x509v3/v3_admis.c $(OPENSSL_PATH)/crypto/x509v3/v3_akey.c $(OPENSSL_PATH)/crypto/x509v3/v3_akeya.c $(OPENSSL_PATH)/crypto/x509v3/v3_alt.c @@ -479,12 +499,14 @@ [Sources] $(OPENSSL_PATH)/ssl/d1_msg.c $(OPENSSL_PATH)/ssl/d1_srtp.c $(OPENSSL_PATH)/ssl/methods.c + $(OPENSSL_PATH)/ssl/packet.c $(OPENSSL_PATH)/ssl/pqueue.c $(OPENSSL_PATH)/ssl/record/dtls1_bitmap.c $(OPENSSL_PATH)/ssl/record/rec_layer_d1.c $(OPENSSL_PATH)/ssl/record/rec_layer_s3.c $(OPENSSL_PATH)/ssl/record/ssl3_buffer.c $(OPENSSL_PATH)/ssl/record/ssl3_record.c + $(OPENSSL_PATH)/ssl/record/ssl3_record_tls13.c $(OPENSSL_PATH)/ssl/s3_cbc.c $(OPENSSL_PATH)/ssl/s3_enc.c $(OPENSSL_PATH)/ssl/s3_lib.c @@ -502,25 +524,45 @@ [Sources] $(OPENSSL_PATH)/ssl/ssl_stat.c $(OPENSSL_PATH)/ssl/ssl_txt.c $(OPENSSL_PATH)/ssl/ssl_utst.c + $(OPENSSL_PATH)/ssl/statem/extensions.c + $(OPENSSL_PATH)/ssl/statem/extensions_clnt.c + $(OPENSSL_PATH)/ssl/statem/extensions_cust.c + $(OPENSSL_PATH)/ssl/statem/extensions_srvr.c $(OPENSSL_PATH)/ssl/statem/statem.c $(OPENSSL_PATH)/ssl/statem/statem_clnt.c $(OPENSSL_PATH)/ssl/statem/statem_dtls.c $(OPENSSL_PATH)/ssl/statem/statem_lib.c $(OPENSSL_PATH)/ssl/statem/statem_srvr.c $(OPENSSL_PATH)/ssl/t1_enc.c - $(OPENSSL_PATH)/ssl/t1_ext.c $(OPENSSL_PATH)/ssl/t1_lib.c - $(OPENSSL_PATH)/ssl/t1_reneg.c $(OPENSSL_PATH)/ssl/t1_trce.c + $(OPENSSL_PATH)/ssl/tls13_enc.c $(OPENSSL_PATH)/ssl/tls_srp.c # Autogenerated files list ends here + ossl_store.c + rand_pool.c + +[Sources.Ia32] + rand_pool_noise_tsc.c + +[Sources.X64] + rand_pool_noise_tsc.c + +[Sources.ARM] + rand_pool_noise.c + +[Sources.AARCH64] + rand_pool_noise.c + [Packages] MdePkg/MdePkg.dec CryptoPkg/CryptoPkg.dec [LibraryClasses] + BaseLib DebugLib + TimerLib [LibraryClasses.ARM] ArmSoftFloatLib diff --git a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf index fd12d112edb2..49599a42d180 100644 --- a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf +++ b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf @@ -1,7 +1,7 @@ ## @file # This module provides OpenSSL Library implementation. # -# Copyright (c) 2010 - 2018, Intel Corporation. All rights reserved.<BR> +# Copyright (c) 2010 - 2019, Intel Corporation. All rights reserved.<BR> # SPDX-License-Identifier: BSD-2-Clause-Patent # ## @@ -15,7 +15,7 @@ [Defines] VERSION_STRING = 1.0 LIBRARY_CLASS = OpensslLib DEFINE OPENSSL_PATH = openssl - DEFINE OPENSSL_FLAGS = -DL_ENDIAN -DOPENSSL_SMALL_FOOTPRINT -D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECATE -DNO_SYSLOG + DEFINE OPENSSL_FLAGS = -DL_ENDIAN -DOPENSSL_SMALL_FOOTPRINT -D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECATE # # VALID_ARCHITECTURES = IA32 X64 ARM AARCH64 @@ -32,6 +32,7 @@ [Sources] $(OPENSSL_PATH)/crypto/aes/aes_misc.c $(OPENSSL_PATH)/crypto/aes/aes_ofb.c $(OPENSSL_PATH)/crypto/aes/aes_wrap.c + $(OPENSSL_PATH)/crypto/aria/aria.c $(OPENSSL_PATH)/crypto/asn1/a_bitstr.c $(OPENSSL_PATH)/crypto/asn1/a_d2i_fp.c $(OPENSSL_PATH)/crypto/asn1/a_digest.c @@ -54,6 +55,7 @@ [Sources] $(OPENSSL_PATH)/crypto/asn1/ameth_lib.c $(OPENSSL_PATH)/crypto/asn1/asn1_err.c $(OPENSSL_PATH)/crypto/asn1/asn1_gen.c + $(OPENSSL_PATH)/crypto/asn1/asn1_item_list.c $(OPENSSL_PATH)/crypto/asn1/asn1_lib.c $(OPENSSL_PATH)/crypto/asn1/asn1_par.c $(OPENSSL_PATH)/crypto/asn1/asn_mime.c @@ -172,6 +174,7 @@ [Sources] $(OPENSSL_PATH)/crypto/conf/conf_ssl.c $(OPENSSL_PATH)/crypto/cpt_err.c $(OPENSSL_PATH)/crypto/cryptlib.c + $(OPENSSL_PATH)/crypto/ctype.c $(OPENSSL_PATH)/crypto/cversion.c $(OPENSSL_PATH)/crypto/des/cbc_cksm.c $(OPENSSL_PATH)/crypto/des/cbc_enc.c @@ -189,7 +192,6 @@ [Sources] $(OPENSSL_PATH)/crypto/des/pcbc_enc.c $(OPENSSL_PATH)/crypto/des/qud_cksm.c $(OPENSSL_PATH)/crypto/des/rand_key.c - $(OPENSSL_PATH)/crypto/des/rpc_enc.c $(OPENSSL_PATH)/crypto/des/set_key.c $(OPENSSL_PATH)/crypto/des/str2key.c $(OPENSSL_PATH)/crypto/des/xcbc_enc.c @@ -206,6 +208,7 @@ [Sources] $(OPENSSL_PATH)/crypto/dh/dh_pmeth.c $(OPENSSL_PATH)/crypto/dh/dh_prn.c $(OPENSSL_PATH)/crypto/dh/dh_rfc5114.c + $(OPENSSL_PATH)/crypto/dh/dh_rfc7919.c $(OPENSSL_PATH)/crypto/dso/dso_dl.c $(OPENSSL_PATH)/crypto/dso/dso_dlfcn.c $(OPENSSL_PATH)/crypto/dso/dso_err.c @@ -228,6 +231,7 @@ [Sources] $(OPENSSL_PATH)/crypto/evp/e_aes.c $(OPENSSL_PATH)/crypto/evp/e_aes_cbc_hmac_sha1.c $(OPENSSL_PATH)/crypto/evp/e_aes_cbc_hmac_sha256.c + $(OPENSSL_PATH)/crypto/evp/e_aria.c $(OPENSSL_PATH)/crypto/evp/e_bf.c $(OPENSSL_PATH)/crypto/evp/e_camellia.c $(OPENSSL_PATH)/crypto/evp/e_cast.c @@ -242,6 +246,7 @@ [Sources] $(OPENSSL_PATH)/crypto/evp/e_rc4_hmac_md5.c $(OPENSSL_PATH)/crypto/evp/e_rc5.c $(OPENSSL_PATH)/crypto/evp/e_seed.c + $(OPENSSL_PATH)/crypto/evp/e_sm4.c $(OPENSSL_PATH)/crypto/evp/e_xcbc_d.c $(OPENSSL_PATH)/crypto/evp/encode.c $(OPENSSL_PATH)/crypto/evp/evp_cnf.c @@ -259,6 +264,7 @@ [Sources] $(OPENSSL_PATH)/crypto/evp/m_null.c $(OPENSSL_PATH)/crypto/evp/m_ripemd.c $(OPENSSL_PATH)/crypto/evp/m_sha1.c + $(OPENSSL_PATH)/crypto/evp/m_sha3.c $(OPENSSL_PATH)/crypto/evp/m_sigver.c $(OPENSSL_PATH)/crypto/evp/m_wp.c $(OPENSSL_PATH)/crypto/evp/names.c @@ -271,10 +277,10 @@ [Sources] $(OPENSSL_PATH)/crypto/evp/p_seal.c $(OPENSSL_PATH)/crypto/evp/p_sign.c $(OPENSSL_PATH)/crypto/evp/p_verify.c + $(OPENSSL_PATH)/crypto/evp/pbe_scrypt.c $(OPENSSL_PATH)/crypto/evp/pmeth_fn.c $(OPENSSL_PATH)/crypto/evp/pmeth_gn.c $(OPENSSL_PATH)/crypto/evp/pmeth_lib.c - $(OPENSSL_PATH)/crypto/evp/scrypt.c $(OPENSSL_PATH)/crypto/ex_data.c $(OPENSSL_PATH)/crypto/getenv.c $(OPENSSL_PATH)/crypto/hmac/hm_ameth.c @@ -283,6 +289,7 @@ [Sources] $(OPENSSL_PATH)/crypto/init.c $(OPENSSL_PATH)/crypto/kdf/hkdf.c $(OPENSSL_PATH)/crypto/kdf/kdf_err.c + $(OPENSSL_PATH)/crypto/kdf/scrypt.c $(OPENSSL_PATH)/crypto/kdf/tls1_prf.c $(OPENSSL_PATH)/crypto/lhash/lh_stats.c $(OPENSSL_PATH)/crypto/lhash/lhash.c @@ -360,14 +367,14 @@ [Sources] $(OPENSSL_PATH)/crypto/pkcs7/pk7_mime.c $(OPENSSL_PATH)/crypto/pkcs7/pk7_smime.c $(OPENSSL_PATH)/crypto/pkcs7/pkcs7err.c - $(OPENSSL_PATH)/crypto/rand/md_rand.c + $(OPENSSL_PATH)/crypto/rand/drbg_ctr.c + $(OPENSSL_PATH)/crypto/rand/drbg_lib.c $(OPENSSL_PATH)/crypto/rand/rand_egd.c $(OPENSSL_PATH)/crypto/rand/rand_err.c $(OPENSSL_PATH)/crypto/rand/rand_lib.c $(OPENSSL_PATH)/crypto/rand/rand_unix.c $(OPENSSL_PATH)/crypto/rand/rand_vms.c $(OPENSSL_PATH)/crypto/rand/rand_win.c - $(OPENSSL_PATH)/crypto/rand/randfile.c $(OPENSSL_PATH)/crypto/rc4/rc4_enc.c $(OPENSSL_PATH)/crypto/rc4/rc4_skey.c $(OPENSSL_PATH)/crypto/rsa/rsa_ameth.c @@ -379,8 +386,8 @@ [Sources] $(OPENSSL_PATH)/crypto/rsa/rsa_gen.c $(OPENSSL_PATH)/crypto/rsa/rsa_lib.c $(OPENSSL_PATH)/crypto/rsa/rsa_meth.c + $(OPENSSL_PATH)/crypto/rsa/rsa_mp.c $(OPENSSL_PATH)/crypto/rsa/rsa_none.c - $(OPENSSL_PATH)/crypto/rsa/rsa_null.c $(OPENSSL_PATH)/crypto/rsa/rsa_oaep.c $(OPENSSL_PATH)/crypto/rsa/rsa_ossl.c $(OPENSSL_PATH)/crypto/rsa/rsa_pk1.c @@ -392,15 +399,27 @@ [Sources] $(OPENSSL_PATH)/crypto/rsa/rsa_ssl.c $(OPENSSL_PATH)/crypto/rsa/rsa_x931.c $(OPENSSL_PATH)/crypto/rsa/rsa_x931g.c + $(OPENSSL_PATH)/crypto/sha/keccak1600.c $(OPENSSL_PATH)/crypto/sha/sha1_one.c $(OPENSSL_PATH)/crypto/sha/sha1dgst.c $(OPENSSL_PATH)/crypto/sha/sha256.c $(OPENSSL_PATH)/crypto/sha/sha512.c + $(OPENSSL_PATH)/crypto/siphash/siphash.c + $(OPENSSL_PATH)/crypto/siphash/siphash_ameth.c + $(OPENSSL_PATH)/crypto/siphash/siphash_pmeth.c + $(OPENSSL_PATH)/crypto/sm3/m_sm3.c + $(OPENSSL_PATH)/crypto/sm3/sm3.c + $(OPENSSL_PATH)/crypto/sm4/sm4.c $(OPENSSL_PATH)/crypto/stack/stack.c $(OPENSSL_PATH)/crypto/threads_none.c $(OPENSSL_PATH)/crypto/threads_pthread.c $(OPENSSL_PATH)/crypto/threads_win.c $(OPENSSL_PATH)/crypto/txt_db/txt_db.c + $(OPENSSL_PATH)/crypto/ui/ui_err.c + $(OPENSSL_PATH)/crypto/ui/ui_lib.c + $(OPENSSL_PATH)/crypto/ui/ui_null.c + $(OPENSSL_PATH)/crypto/ui/ui_openssl.c + $(OPENSSL_PATH)/crypto/ui/ui_util.c $(OPENSSL_PATH)/crypto/uid.c $(OPENSSL_PATH)/crypto/x509/by_dir.c $(OPENSSL_PATH)/crypto/x509/by_file.c @@ -445,6 +464,7 @@ [Sources] $(OPENSSL_PATH)/crypto/x509v3/pcy_node.c $(OPENSSL_PATH)/crypto/x509v3/pcy_tree.c $(OPENSSL_PATH)/crypto/x509v3/v3_addr.c + $(OPENSSL_PATH)/crypto/x509v3/v3_admis.c $(OPENSSL_PATH)/crypto/x509v3/v3_akey.c $(OPENSSL_PATH)/crypto/x509v3/v3_akeya.c $(OPENSSL_PATH)/crypto/x509v3/v3_alt.c @@ -476,12 +496,29 @@ [Sources] $(OPENSSL_PATH)/crypto/x509v3/v3err.c # Autogenerated files list ends here + ossl_store.c + rand_pool.c + +[Sources.Ia32] + rand_pool_noise_tsc.c + +[Sources.X64] + rand_pool_noise_tsc.c + +[Sources.ARM] + rand_pool_noise.c + +[Sources.AARCH64] + rand_pool_noise.c + [Packages] MdePkg/MdePkg.dec CryptoPkg/CryptoPkg.dec [LibraryClasses] + BaseLib DebugLib + TimerLib [LibraryClasses.ARM] ArmSoftFloatLib diff --git a/CryptoPkg/Library/Include/CrtLibSupport.h b/CryptoPkg/Library/Include/CrtLibSupport.h index b05c5d908ce2..5806f50f7485 100644 --- a/CryptoPkg/Library/Include/CrtLibSupport.h +++ b/CryptoPkg/Library/Include/CrtLibSupport.h @@ -2,7 +2,7 @@ Root include file of C runtime library to support building the third-party cryptographic library. -Copyright (c) 2010 - 2017, Intel Corporation. All rights reserved.<BR> +Copyright (c) 2010 - 2019, Intel Corporation. All rights reserved.<BR> SPDX-License-Identifier: BSD-2-Clause-Patent **/ @@ -21,6 +21,17 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #define MAX_STRING_SIZE 0x1000 // +// We already have "no-ui" in out Configure invocation. +// but the code still fails to compile. +// Ref: https://github.com/openssl/openssl/issues/8904 +// +// This is defined in CRT library(stdio.h). +// +#ifndef BUFSIZ +#define BUFSIZ 8192 +#endif + +// // OpenSSL relies on explicit configuration for word size in crypto/bn, // but we want it to be automatically inferred from the target. So we // bypass what's in <openssl/opensslconf.h> for OPENSSL_SYS_UEFI, and diff --git a/CryptoPkg/Library/Include/openssl/opensslconf.h b/CryptoPkg/Library/Include/openssl/opensslconf.h index 28dd9ab93c61..07fa2d3ce280 100644 --- a/CryptoPkg/Library/Include/openssl/opensslconf.h +++ b/CryptoPkg/Library/Include/openssl/opensslconf.h @@ -10,6 +10,8 @@ * https://www.openssl.org/source/license.html */ +#include <openssl/opensslv.h> + #ifdef __cplusplus extern "C" { #endif @@ -77,18 +79,21 @@ extern "C" { #ifndef OPENSSL_NO_SEED # define OPENSSL_NO_SEED #endif +#ifndef OPENSSL_NO_SM2 +# define OPENSSL_NO_SM2 +#endif #ifndef OPENSSL_NO_SRP # define OPENSSL_NO_SRP #endif #ifndef OPENSSL_NO_TS # define OPENSSL_NO_TS #endif -#ifndef OPENSSL_NO_UI -# define OPENSSL_NO_UI -#endif #ifndef OPENSSL_NO_WHIRLPOOL # define OPENSSL_NO_WHIRLPOOL #endif +#ifndef OPENSSL_RAND_SEED_NONE +# define OPENSSL_RAND_SEED_NONE +#endif #ifndef OPENSSL_NO_AFALGENG # define OPENSSL_NO_AFALGENG #endif @@ -122,6 +127,9 @@ extern "C" { #ifndef OPENSSL_NO_DEPRECATED # define OPENSSL_NO_DEPRECATED #endif +#ifndef OPENSSL_NO_DEVCRYPTOENG +# define OPENSSL_NO_DEVCRYPTOENG +#endif #ifndef OPENSSL_NO_DGRAM # define OPENSSL_NO_DGRAM #endif @@ -155,6 +163,9 @@ extern "C" { #ifndef OPENSSL_NO_ERR # define OPENSSL_NO_ERR #endif +#ifndef OPENSSL_NO_EXTERNAL_TESTS +# define OPENSSL_NO_EXTERNAL_TESTS +#endif #ifndef OPENSSL_NO_FILENAMES # define OPENSSL_NO_FILENAMES #endif @@ -209,15 +220,24 @@ extern "C" { #ifndef OPENSSL_NO_TESTS # define OPENSSL_NO_TESTS #endif +#ifndef OPENSSL_NO_TLS1_3 +# define OPENSSL_NO_TLS1_3 +#endif #ifndef OPENSSL_NO_UBSAN # define OPENSSL_NO_UBSAN #endif +#ifndef OPENSSL_NO_UI_CONSOLE +# define OPENSSL_NO_UI_CONSOLE +#endif #ifndef OPENSSL_NO_UNIT_TEST # define OPENSSL_NO_UNIT_TEST #endif #ifndef OPENSSL_NO_WEAK_SSL_CIPHERS # define OPENSSL_NO_WEAK_SSL_CIPHERS #endif +#ifndef OPENSSL_NO_DYNAMIC_ENGINE +# define OPENSSL_NO_DYNAMIC_ENGINE +#endif #ifndef OPENSSL_NO_AFALGENG # define OPENSSL_NO_AFALGENG #endif @@ -236,15 +256,11 @@ extern "C" { * functions. */ #ifndef DECLARE_DEPRECATED -# if defined(OPENSSL_NO_DEPRECATED) -# define DECLARE_DEPRECATED(f) -# else -# define DECLARE_DEPRECATED(f) f; -# ifdef __GNUC__ -# if __GNUC__ > 3 || (__GNUC__ == 3 && __GNUC_MINOR__ > 0) -# undef DECLARE_DEPRECATED -# define DECLARE_DEPRECATED(f) f __attribute__ ((deprecated)); -# endif +# define DECLARE_DEPRECATED(f) f; +# ifdef __GNUC__ +# if __GNUC__ > 3 || (__GNUC__ == 3 && __GNUC_MINOR__ > 0) +# undef DECLARE_DEPRECATED +# define DECLARE_DEPRECATED(f) f __attribute__ ((deprecated)); # endif # endif #endif @@ -268,6 +284,18 @@ extern "C" { # define OPENSSL_API_COMPAT OPENSSL_MIN_API #endif +/* + * Do not deprecate things to be deprecated in version 1.2.0 before the + * OpenSSL version number matches. + */ +#if OPENSSL_VERSION_NUMBER < 0x10200000L +# define DEPRECATEDIN_1_2_0(f) f; +#elif OPENSSL_API_COMPAT < 0x10200000L +# define DEPRECATEDIN_1_2_0(f) DECLARE_DEPRECATED(f) +#else +# define DEPRECATEDIN_1_2_0(f) +#endif + #if OPENSSL_API_COMPAT < 0x10100000L # define DEPRECATEDIN_1_1_0(f) DECLARE_DEPRECATED(f) #else @@ -286,8 +314,6 @@ extern "C" { # define DEPRECATEDIN_0_9_8(f) #endif - - /* Generate 80386 code? */ #undef I386_ONLY diff --git a/CryptoPkg/Library/OpensslLib/buildinf.h b/CryptoPkg/Library/OpensslLib/buildinf.h index c5ca293c729f..b840c8656a28 100644 --- a/CryptoPkg/Library/OpensslLib/buildinf.h +++ b/CryptoPkg/Library/OpensslLib/buildinf.h @@ -1,2 +1,4 @@ #define PLATFORM "UEFI" #define DATE "Fri Dec 22 01:23:45 PDT 2017" + +const char * compiler_flags = "compiler: information not available from edk2"; diff --git a/CryptoPkg/Library/OpensslLib/rand_pool_noise.h b/CryptoPkg/Library/OpensslLib/rand_pool_noise.h new file mode 100644 index 000000000000..75acc686a9f1 --- /dev/null +++ b/CryptoPkg/Library/OpensslLib/rand_pool_noise.h @@ -0,0 +1,29 @@ +/** @file + Provide rand noise source. + +Copyright (c) 2019, Intel Corporation. All rights reserved.<BR> +SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#ifndef __RAND_POOL_NOISE_H__ +#define __RAND_POOL_NOISE_H__ + +#include <Uefi/UefiBaseType.h> + +/** + Get 64-bit noise source. + + @param[out] Rand Buffer pointer to store 64-bit noise source + + @retval TRUE Get randomness successfully. + @retval FALSE Failed to generate +**/ +BOOLEAN +EFIAPI +GetRandomNoise64 ( + OUT UINT64 *Rand + ); + + +#endif // __RAND_POOL_NOISE_H__ diff --git a/CryptoPkg/Library/OpensslLib/ossl_store.c b/CryptoPkg/Library/OpensslLib/ossl_store.c new file mode 100644 index 000000000000..29e1506048e3 --- /dev/null +++ b/CryptoPkg/Library/OpensslLib/ossl_store.c @@ -0,0 +1,17 @@ +/** @file + Dummy implement ossl_store(Store retrieval functions) for UEFI. + +Copyright (c) 2019, Intel Corporation. All rights reserved.<BR> +SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +/* + * This function is cleanup ossl store. + * + * Dummy Implement for UEFI + */ +void ossl_store_cleanup_int(void) +{ +} + diff --git a/CryptoPkg/Library/OpensslLib/rand_pool.c b/CryptoPkg/Library/OpensslLib/rand_pool.c new file mode 100644 index 000000000000..9d2a4ad13823 --- /dev/null +++ b/CryptoPkg/Library/OpensslLib/rand_pool.c @@ -0,0 +1,316 @@ +/** @file + OpenSSL_1_1_1b doesn't implement rand_pool_* functions for UEFI. + The file implement these functions. + +Copyright (c) 2019, Intel Corporation. All rights reserved.<BR> +SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#include "internal/rand_int.h" +#include <openssl/aes.h> + +#include <Uefi.h> +#include <Library/TimerLib.h> + +#include "rand_pool_noise.h" + +/** + Get some randomness from low-order bits of GetPerformanceCounter results. + And combine them to the 64-bit value + + @param[out] Rand Buffer pointer to store the 64-bit random value. + + @retval TRUE Random number generated successfully. + @retval FALSE Failed to generate. +**/ +STATIC +BOOLEAN +EFIAPI +GetRandNoise64FromPerformanceCounter( + OUT UINT64 *Rand + ) +{ + UINT32 Index; + UINT32 *RandPtr; + + if (NULL == Rand) { + return FALSE; + } + + RandPtr = (UINT32 *) Rand; + + for (Index = 0; Index < 2; Index ++) { + *RandPtr = (UINT32) (GetPerformanceCounter () & 0xFF); + MicroSecondDelay (10); + RandPtr++; + } + + return TRUE; +} + +/** + Calls RandomNumber64 to fill + a buffer of arbitrary size with random bytes. + + @param[in] Length Size of the buffer, in bytes, to fill with. + @param[out] RandBuffer Pointer to the buffer to store the random result. + + @retval EFI_SUCCESS Random bytes generation succeeded. + @retval EFI_NOT_READY Failed to request random bytes. + +**/ +STATIC +BOOLEAN +EFIAPI +RandGetBytes ( + IN UINTN Length, + OUT UINT8 *RandBuffer + ) +{ + BOOLEAN Ret; + UINT64 TempRand; + + Ret = FALSE; + + while (Length > 0) { + // + // Get random noise from platform. + // If it failed, fallback to PerformanceCounter + // If you really care about security, you must override + // GetRandomNoise64FromPlatform. + // + Ret = GetRandomNoise64 (&TempRand); + if (Ret == FALSE) { + Ret = GetRandNoise64FromPerformanceCounter (&TempRand); + } + if (!Ret) { + return Ret; + } + if (Length >= sizeof (TempRand)) { + *((UINT64*) RandBuffer) = TempRand; + RandBuffer += sizeof (UINT64); + Length -= sizeof (TempRand); + } else { + CopyMem (RandBuffer, &TempRand, Length); + Length = 0; + } + } + + return Ret; +} + +/** + Creates a 128bit random value that is fully forward and backward prediction resistant, + suitable for seeding a NIST SP800-90 Compliant. + This function takes multiple random numbers from PerformanceCounter to ensure reseeding + and performs AES-CBC-MAC over the data to compute the seed value. + + @param[out] SeedBuffer Pointer to a 128bit buffer to store the random seed. + + @retval TRUE Random seed generation succeeded. + @retval FALSE Failed to request random bytes. + +**/ +STATIC +BOOLEAN +EFIAPI +RandGetSeed128 ( + OUT UINT8 *SeedBuffer + ) +{ + BOOLEAN Ret; + UINT8 RandByte[16]; + UINT8 Key[16]; + UINT8 Ffv[16]; + UINT8 Xored[16]; + UINT32 Index; + UINT32 Index2; + AES_KEY AESKey; + + // + // Chose an arbitary key and zero the feed_forward_value (FFV) + // + for (Index = 0; Index < 16; Index++) { + Key[Index] = (UINT8) Index; + Ffv[Index] = 0; + } + + AES_set_encrypt_key (Key, 16 * 8, &AESKey); + + // + // Perform CBC_MAC over 32 * 128 bit values, with 10us gaps between 128 bit value + // The 10us gaps will ensure multiple reseeds within the system time with a large + // design margin. + // + for (Index = 0; Index < 32; Index++) { + MicroSecondDelay (10); + Ret = RandGetBytes (16, RandByte); + if (!Ret) { + return Ret; + } + + // + // Perform XOR operations on two 128-bit value. + // + for (Index2 = 0; Index2 < 16; Index2++) { + Xored[Index2] = RandByte[Index2] ^ Ffv[Index2]; + } + + AES_encrypt (Xored, Ffv, &AESKey); + } + + for (Index = 0; Index < 16; Index++) { + SeedBuffer[Index] = Ffv[Index]; + } + + return Ret; +} + +/** + Generate high-quality entropy source. + + @param[in] Length Size of the buffer, in bytes, to fill with. + @param[out] Entropy Pointer to the buffer to store the entropy data. + + @retval EFI_SUCCESS Entropy generation succeeded. + @retval EFI_NOT_READY Failed to request random data. + +**/ +STATIC +BOOLEAN +EFIAPI +RandGenerateEntropy ( + IN UINTN Length, + OUT UINT8 *Entropy + ) +{ + BOOLEAN Ret; + UINTN BlockCount; + UINT8 Seed[16]; + UINT8 *Ptr; + + BlockCount = Length / 16; + Ptr = (UINT8 *) Entropy; + + // + // Generate high-quality seed for DRBG Entropy + // + while (BlockCount > 0) { + Ret = RandGetSeed128 (Seed); + if (!Ret) { + return Ret; + } + CopyMem (Ptr, Seed, 16); + + BlockCount--; + Ptr = Ptr + 16; + } + + // + // Populate the remained data as request. + // + Ret = RandGetSeed128 (Seed); + if (!Ret) { + return Ret; + } + CopyMem (Ptr, Seed, (Length % 16)); + + return Ret; +} + +/* + * Add random bytes to the pool to acquire requested amount of entropy + * + * This function is platform specific and tries to acquire the requested + * amount of entropy by polling platform specific entropy sources. + * + * This is OpenSSL required interface. + */ +size_t rand_pool_acquire_entropy(RAND_POOL *pool) +{ + BOOLEAN Ret; + size_t bytes_needed; + unsigned char * buffer; + + bytes_needed = rand_pool_bytes_needed(pool, 1 /*entropy_factor*/); + if (bytes_needed > 0) { + buffer = rand_pool_add_begin(pool, bytes_needed); + + if (buffer != NULL) { + Ret = RandGenerateEntropy(bytes_needed, buffer); + if (FALSE == Ret) { + rand_pool_add_end(pool, 0, 0); + } else { + rand_pool_add_end(pool, bytes_needed, 8 * bytes_needed); + } + } + } + + return rand_pool_entropy_available(pool); +} + +/* + * Implementation for UEFI + * + * This is OpenSSL required interface. + */ +int rand_pool_add_nonce_data(RAND_POOL *pool) +{ + struct { + UINT64 Rand; + UINT64 TimerValue; + } data = { 0 }; + + RandGetBytes(8, (UINT8 *)&(data.Rand)); + data.TimerValue = GetPerformanceCounter(); + + return rand_pool_add(pool, (unsigned char*)&data, sizeof(data), 0); +} + +/* + * Implementation for UEFI + * + * This is OpenSSL required interface. + */ +int rand_pool_add_additional_data(RAND_POOL *pool) +{ + struct { + UINT64 Rand; + UINT64 TimerValue; + } data = { 0 }; + + RandGetBytes(8, (UINT8 *)&(data.Rand)); + data.TimerValue = GetPerformanceCounter(); + + return rand_pool_add(pool, (unsigned char*)&data, sizeof(data), 0); +} + +/* + * Dummy Implememtation for UEFI + * + * This is OpenSSL required interface. + */ +int rand_pool_init(void) +{ + return 1; +} + +/* + * Dummy Implememtation for UEFI + * + * This is OpenSSL required interface. + */ +void rand_pool_cleanup(void) +{ +} + +/* + * Dummy Implememtation for UEFI + * + * This is OpenSSL required interface. + */ +void rand_pool_keep_random_devices_open(int keep) +{ +} + diff --git a/CryptoPkg/Library/OpensslLib/rand_pool_noise.c b/CryptoPkg/Library/OpensslLib/rand_pool_noise.c new file mode 100644 index 000000000000..c16ed8b45496 --- /dev/null +++ b/CryptoPkg/Library/OpensslLib/rand_pool_noise.c @@ -0,0 +1,29 @@ +/** @file + Provide rand noise source. + +Copyright (c) 2019, Intel Corporation. All rights reserved.<BR> +SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#include <Library/BaseLib.h> + +/** + Get 64-bit noise source + + @param[out] Rand Buffer pointer to store 64-bit noise source + + @retval FALSE Failed to generate +**/ +BOOLEAN +EFIAPI +GetRandomNoise64 ( + OUT UINT64 *Rand + ) +{ + // + // Return FALSE will fallback to use PerformaceCounter to + // generate noise. + // + return FALSE; +} diff --git a/CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c b/CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c new file mode 100644 index 000000000000..4158106231fd --- /dev/null +++ b/CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c @@ -0,0 +1,43 @@ +/** @file + Provide rand noise source. + +Copyright (c) 2019, Intel Corporation. All rights reserved.<BR> +SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#include <Library/BaseLib.h> +#include <Library/DebugLib.h> +#include <Library/TimerLib.h> + +/** + Get 64-bit noise source + + @param[out] Rand Buffer pointer to store 64-bit noise source + + @retval TRUE Get randomness successfully. + @retval FALSE Failed to generate +**/ +BOOLEAN +EFIAPI +GetRandomNoise64 ( + OUT UINT64 *Rand + ) +{ + UINT32 Index; + UINT32 *RandPtr; + + if (NULL == Rand) { + return FALSE; + } + + RandPtr = (UINT32 *)Rand; + + for (Index = 0; Index < 2; Index ++) { + *RandPtr = (UINT32) ((AsmReadTsc ()) & 0xFF); + RandPtr++; + MicroSecondDelay (10); + } + + return TRUE; +} diff --git a/CryptoPkg/Library/OpensslLib/openssl b/CryptoPkg/Library/OpensslLib/openssl index 74f2d9c1ec5f..50eaac9f3337 160000 --- a/CryptoPkg/Library/OpensslLib/openssl +++ b/CryptoPkg/Library/OpensslLib/openssl @@ -1 +1 @@ -Subproject commit 74f2d9c1ec5f5510e1d3da5a9f03c28df0977762 +Subproject commit 50eaac9f3337667259de725451f201e784599687 -- 2.7.4 ^ permalink raw reply related [flat|nested] 39+ messages in thread
* Re: [edk2-devel] [PATCH v4 6/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b 2019-05-16 7:54 ` [PATCH v4 6/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b Xiaoyu lu @ 2019-05-16 16:31 ` Laszlo Ersek 2019-05-17 11:14 ` Xiaoyu Lu 0 siblings, 1 reply; 39+ messages in thread From: Laszlo Ersek @ 2019-05-16 16:31 UTC (permalink / raw) To: devel, xiaoyux.lu, Jian J Wang; +Cc: Ting Ye Hi Jian, On 05/16/19 09:54, Xiaoyu lu wrote: > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1089 > > * Update OpenSSL submodule to OpenSSL_1_1_1b > OpenSSL_1_1_1b(50eaac9f3337667259de725451f201e784599687) > > * Run process_files.pl script to regenerate OpensslLib[Crypto].inf > and opensslconf.h > > * Remove -DNO_SYSLOG from OPENSSL_FLAGS in OpensslLib[Crypto].inf, > due to upstream OpenSSL commit cff55b90e95e("Cleaning UEFI > Build with additional OPENSSL_SYS_UEFI flags", 2017-03-29), > which was first released as part of OpenSSL_1_1_1. > > * Starting with OpenSSL commit 8a8d9e1905(first release in > OpenSSL_1_1_1), the OpenSSL_version() function can no longer > return a pointer to the string literal "compiler: information > not available", in the case CFLAGS macro is not defined. > Instead, the function now has a hard dependency on the global > variable 'compiler_flags'. This variable is normally placed > by "util/mkbuildinf.pl" into "buildinf.h". In edk2 we don't > run that script whenever we build OpenSSL, therefore we > must provide our own dummy 'compiler_flags'. > > * From OpenSSL_1_1_0i(97c0959f27b294fe1eb10b547145ebef2524b896) to > OpenSSL_1_1_1b(50eaac9f3337667259de725451f201e784599687), OpenSSL > updated DRBG / RAND to request nonce and additional low entropy > randomness from system(line 229 openssl/CHANGES). > > Since OpenSSL_1_1_1b doesn't fully implement rand pool functions > for UEFI. We must provide a method to implenet these method. > TSC is used as first entropy source if it's availabe otherwise > fallback to TimerLib. But we are not sure the amount of randomness > they provide. If you really care about the security, one choice is > overrided it with hardware generator. > > Add rand_pool.c to implement these functions required by OpenSSL > rand_pool_acquire_entropy > rand_pool_add_nonce_data > rand_pool_add_additional_data > rand_pool_init > rand_pool_cleanup > rand_pool_keep_random_devices_open > > And add rand_pool_noise.* for getting entropy noise from different > architecture. > > * We don't need ossl_store functions. We exclude relative files > through process_files.pl. And ossl_store_cleanup_int was first > added in crypto/init.c OpenSSL_1_1_1(71a5516d). > So add a new file(ossl_store.c) to implement ossl_store_cleanup_int > function. > > * BUFSIZ is used by crypto/evp/evp_key.c(OpenSSL_1_1_1b) > And it is declared in stdio.h. So add it to CrtLibSupport.h. > Here's a discussion about this. > Ref: https://github.com/openssl/openssl/issues/8904 > > Cc: Jian J Wang <jian.j.wang@intel.com> > Cc: Ting Ye <ting.ye@intel.com> > Signed-off-by: Xiaoyu Lu <xiaoyux.lu@intel.com> > --- > CryptoPkg/Library/OpensslLib/OpensslLib.inf | 60 +++- > CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 51 +++- > CryptoPkg/Library/Include/CrtLibSupport.h | 13 +- > CryptoPkg/Library/Include/openssl/opensslconf.h | 54 +++- > CryptoPkg/Library/OpensslLib/buildinf.h | 2 + > CryptoPkg/Library/OpensslLib/rand_pool_noise.h | 29 ++ > CryptoPkg/Library/OpensslLib/ossl_store.c | 17 ++ > CryptoPkg/Library/OpensslLib/rand_pool.c | 316 +++++++++++++++++++++ > CryptoPkg/Library/OpensslLib/rand_pool_noise.c | 29 ++ > CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c | 43 +++ > CryptoPkg/Library/OpensslLib/openssl | 2 +- > 11 files changed, 584 insertions(+), 32 deletions(-) > create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.h > create mode 100644 CryptoPkg/Library/OpensslLib/ossl_store.c > create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool.c > create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.c > create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c For this patch, I can offer two kinds of reviews: ---*--- (a) If you prefer to push this patch in the present form (that is, exactly as posted), then I will not give any official feedback tags, due to the crypto contents. I will not block the patch either, so if you and Ting are fine with the patch, it's OK for you to push it, from my side. ---*--- (b) Alternatively, you could split the patch in two halves, as follows: (b/1) In the first half, collect all the hunks for the following files: CryptoPkg/Library/OpensslLib/ossl_store.c CryptoPkg/Library/OpensslLib/rand_pool.c CryptoPkg/Library/OpensslLib/rand_pool_noise.c CryptoPkg/Library/OpensslLib/rand_pool_noise.h CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c plus include the commit message paragraphs about "rand_pool.c" and "ossl_store.c". For this half (b/1), I will not give any feedback. (b/2) In the second half, collect the rest of the changes, that is, the hunks for the following files / submodules, and the rest of the commit message: CryptoPkg/Library/Include/CrtLibSupport.h CryptoPkg/Library/Include/openssl/opensslconf.h CryptoPkg/Library/OpensslLib/OpensslLib.inf CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf CryptoPkg/Library/OpensslLib/buildinf.h CryptoPkg/Library/OpensslLib/openssl For the (b/2) half *ONLY*, you can add: Reviewed-by: Laszlo Ersek <lersek@redhat.com> ---*--- It's up to you whether you pick (a) or (b). Normally I would request a v5 series for implementing (b), but we're out of time. If the community thinks that splitting up this patch into halves (b/1) and (b/2) is too intrusive for a maintainer to do without proper review, then I suggest going with (a) -- and then I'll provide no feedback tags. (But, I will also not block the patch, see above.) ... Well, in theory anyway, Xiaoyu could very quickly submit a v5 series, splitting this patch as explained under (b). In that case, the (b/2) half -- and *ONLY* that half -- of this patch could include my R-b at once. So, please decide. Thanks! Laszlo > > diff --git a/CryptoPkg/Library/OpensslLib/OpensslLib.inf b/CryptoPkg/Library/OpensslLib/OpensslLib.inf > index f4d7772c068c..62dd61969cb0 100644 > --- a/CryptoPkg/Library/OpensslLib/OpensslLib.inf > +++ b/CryptoPkg/Library/OpensslLib/OpensslLib.inf > @@ -1,7 +1,7 @@ > ## @file > # This module provides OpenSSL Library implementation. > # > -# Copyright (c) 2010 - 2018, Intel Corporation. All rights reserved.<BR> > +# Copyright (c) 2010 - 2019, Intel Corporation. All rights reserved.<BR> > # SPDX-License-Identifier: BSD-2-Clause-Patent > # > ## > @@ -15,7 +15,7 @@ [Defines] > VERSION_STRING = 1.0 > LIBRARY_CLASS = OpensslLib > DEFINE OPENSSL_PATH = openssl > - DEFINE OPENSSL_FLAGS = -DL_ENDIAN -DOPENSSL_SMALL_FOOTPRINT -D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECATE -DNO_SYSLOG > + DEFINE OPENSSL_FLAGS = -DL_ENDIAN -DOPENSSL_SMALL_FOOTPRINT -D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECATE > > # > # VALID_ARCHITECTURES = IA32 X64 ARM AARCH64 > @@ -32,6 +32,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/aes/aes_misc.c > $(OPENSSL_PATH)/crypto/aes/aes_ofb.c > $(OPENSSL_PATH)/crypto/aes/aes_wrap.c > + $(OPENSSL_PATH)/crypto/aria/aria.c > $(OPENSSL_PATH)/crypto/asn1/a_bitstr.c > $(OPENSSL_PATH)/crypto/asn1/a_d2i_fp.c > $(OPENSSL_PATH)/crypto/asn1/a_digest.c > @@ -54,6 +55,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/asn1/ameth_lib.c > $(OPENSSL_PATH)/crypto/asn1/asn1_err.c > $(OPENSSL_PATH)/crypto/asn1/asn1_gen.c > + $(OPENSSL_PATH)/crypto/asn1/asn1_item_list.c > $(OPENSSL_PATH)/crypto/asn1/asn1_lib.c > $(OPENSSL_PATH)/crypto/asn1/asn1_par.c > $(OPENSSL_PATH)/crypto/asn1/asn_mime.c > @@ -172,6 +174,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/conf/conf_ssl.c > $(OPENSSL_PATH)/crypto/cpt_err.c > $(OPENSSL_PATH)/crypto/cryptlib.c > + $(OPENSSL_PATH)/crypto/ctype.c > $(OPENSSL_PATH)/crypto/cversion.c > $(OPENSSL_PATH)/crypto/des/cbc_cksm.c > $(OPENSSL_PATH)/crypto/des/cbc_enc.c > @@ -189,7 +192,6 @@ [Sources] > $(OPENSSL_PATH)/crypto/des/pcbc_enc.c > $(OPENSSL_PATH)/crypto/des/qud_cksm.c > $(OPENSSL_PATH)/crypto/des/rand_key.c > - $(OPENSSL_PATH)/crypto/des/rpc_enc.c > $(OPENSSL_PATH)/crypto/des/set_key.c > $(OPENSSL_PATH)/crypto/des/str2key.c > $(OPENSSL_PATH)/crypto/des/xcbc_enc.c > @@ -206,6 +208,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/dh/dh_pmeth.c > $(OPENSSL_PATH)/crypto/dh/dh_prn.c > $(OPENSSL_PATH)/crypto/dh/dh_rfc5114.c > + $(OPENSSL_PATH)/crypto/dh/dh_rfc7919.c > $(OPENSSL_PATH)/crypto/dso/dso_dl.c > $(OPENSSL_PATH)/crypto/dso/dso_dlfcn.c > $(OPENSSL_PATH)/crypto/dso/dso_err.c > @@ -228,6 +231,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/evp/e_aes.c > $(OPENSSL_PATH)/crypto/evp/e_aes_cbc_hmac_sha1.c > $(OPENSSL_PATH)/crypto/evp/e_aes_cbc_hmac_sha256.c > + $(OPENSSL_PATH)/crypto/evp/e_aria.c > $(OPENSSL_PATH)/crypto/evp/e_bf.c > $(OPENSSL_PATH)/crypto/evp/e_camellia.c > $(OPENSSL_PATH)/crypto/evp/e_cast.c > @@ -242,6 +246,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/evp/e_rc4_hmac_md5.c > $(OPENSSL_PATH)/crypto/evp/e_rc5.c > $(OPENSSL_PATH)/crypto/evp/e_seed.c > + $(OPENSSL_PATH)/crypto/evp/e_sm4.c > $(OPENSSL_PATH)/crypto/evp/e_xcbc_d.c > $(OPENSSL_PATH)/crypto/evp/encode.c > $(OPENSSL_PATH)/crypto/evp/evp_cnf.c > @@ -259,6 +264,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/evp/m_null.c > $(OPENSSL_PATH)/crypto/evp/m_ripemd.c > $(OPENSSL_PATH)/crypto/evp/m_sha1.c > + $(OPENSSL_PATH)/crypto/evp/m_sha3.c > $(OPENSSL_PATH)/crypto/evp/m_sigver.c > $(OPENSSL_PATH)/crypto/evp/m_wp.c > $(OPENSSL_PATH)/crypto/evp/names.c > @@ -271,10 +277,10 @@ [Sources] > $(OPENSSL_PATH)/crypto/evp/p_seal.c > $(OPENSSL_PATH)/crypto/evp/p_sign.c > $(OPENSSL_PATH)/crypto/evp/p_verify.c > + $(OPENSSL_PATH)/crypto/evp/pbe_scrypt.c > $(OPENSSL_PATH)/crypto/evp/pmeth_fn.c > $(OPENSSL_PATH)/crypto/evp/pmeth_gn.c > $(OPENSSL_PATH)/crypto/evp/pmeth_lib.c > - $(OPENSSL_PATH)/crypto/evp/scrypt.c > $(OPENSSL_PATH)/crypto/ex_data.c > $(OPENSSL_PATH)/crypto/getenv.c > $(OPENSSL_PATH)/crypto/hmac/hm_ameth.c > @@ -283,6 +289,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/init.c > $(OPENSSL_PATH)/crypto/kdf/hkdf.c > $(OPENSSL_PATH)/crypto/kdf/kdf_err.c > + $(OPENSSL_PATH)/crypto/kdf/scrypt.c > $(OPENSSL_PATH)/crypto/kdf/tls1_prf.c > $(OPENSSL_PATH)/crypto/lhash/lh_stats.c > $(OPENSSL_PATH)/crypto/lhash/lhash.c > @@ -360,14 +367,14 @@ [Sources] > $(OPENSSL_PATH)/crypto/pkcs7/pk7_mime.c > $(OPENSSL_PATH)/crypto/pkcs7/pk7_smime.c > $(OPENSSL_PATH)/crypto/pkcs7/pkcs7err.c > - $(OPENSSL_PATH)/crypto/rand/md_rand.c > + $(OPENSSL_PATH)/crypto/rand/drbg_ctr.c > + $(OPENSSL_PATH)/crypto/rand/drbg_lib.c > $(OPENSSL_PATH)/crypto/rand/rand_egd.c > $(OPENSSL_PATH)/crypto/rand/rand_err.c > $(OPENSSL_PATH)/crypto/rand/rand_lib.c > $(OPENSSL_PATH)/crypto/rand/rand_unix.c > $(OPENSSL_PATH)/crypto/rand/rand_vms.c > $(OPENSSL_PATH)/crypto/rand/rand_win.c > - $(OPENSSL_PATH)/crypto/rand/randfile.c > $(OPENSSL_PATH)/crypto/rc4/rc4_enc.c > $(OPENSSL_PATH)/crypto/rc4/rc4_skey.c > $(OPENSSL_PATH)/crypto/rsa/rsa_ameth.c > @@ -379,8 +386,8 @@ [Sources] > $(OPENSSL_PATH)/crypto/rsa/rsa_gen.c > $(OPENSSL_PATH)/crypto/rsa/rsa_lib.c > $(OPENSSL_PATH)/crypto/rsa/rsa_meth.c > + $(OPENSSL_PATH)/crypto/rsa/rsa_mp.c > $(OPENSSL_PATH)/crypto/rsa/rsa_none.c > - $(OPENSSL_PATH)/crypto/rsa/rsa_null.c > $(OPENSSL_PATH)/crypto/rsa/rsa_oaep.c > $(OPENSSL_PATH)/crypto/rsa/rsa_ossl.c > $(OPENSSL_PATH)/crypto/rsa/rsa_pk1.c > @@ -392,15 +399,27 @@ [Sources] > $(OPENSSL_PATH)/crypto/rsa/rsa_ssl.c > $(OPENSSL_PATH)/crypto/rsa/rsa_x931.c > $(OPENSSL_PATH)/crypto/rsa/rsa_x931g.c > + $(OPENSSL_PATH)/crypto/sha/keccak1600.c > $(OPENSSL_PATH)/crypto/sha/sha1_one.c > $(OPENSSL_PATH)/crypto/sha/sha1dgst.c > $(OPENSSL_PATH)/crypto/sha/sha256.c > $(OPENSSL_PATH)/crypto/sha/sha512.c > + $(OPENSSL_PATH)/crypto/siphash/siphash.c > + $(OPENSSL_PATH)/crypto/siphash/siphash_ameth.c > + $(OPENSSL_PATH)/crypto/siphash/siphash_pmeth.c > + $(OPENSSL_PATH)/crypto/sm3/m_sm3.c > + $(OPENSSL_PATH)/crypto/sm3/sm3.c > + $(OPENSSL_PATH)/crypto/sm4/sm4.c > $(OPENSSL_PATH)/crypto/stack/stack.c > $(OPENSSL_PATH)/crypto/threads_none.c > $(OPENSSL_PATH)/crypto/threads_pthread.c > $(OPENSSL_PATH)/crypto/threads_win.c > $(OPENSSL_PATH)/crypto/txt_db/txt_db.c > + $(OPENSSL_PATH)/crypto/ui/ui_err.c > + $(OPENSSL_PATH)/crypto/ui/ui_lib.c > + $(OPENSSL_PATH)/crypto/ui/ui_null.c > + $(OPENSSL_PATH)/crypto/ui/ui_openssl.c > + $(OPENSSL_PATH)/crypto/ui/ui_util.c > $(OPENSSL_PATH)/crypto/uid.c > $(OPENSSL_PATH)/crypto/x509/by_dir.c > $(OPENSSL_PATH)/crypto/x509/by_file.c > @@ -445,6 +464,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/x509v3/pcy_node.c > $(OPENSSL_PATH)/crypto/x509v3/pcy_tree.c > $(OPENSSL_PATH)/crypto/x509v3/v3_addr.c > + $(OPENSSL_PATH)/crypto/x509v3/v3_admis.c > $(OPENSSL_PATH)/crypto/x509v3/v3_akey.c > $(OPENSSL_PATH)/crypto/x509v3/v3_akeya.c > $(OPENSSL_PATH)/crypto/x509v3/v3_alt.c > @@ -479,12 +499,14 @@ [Sources] > $(OPENSSL_PATH)/ssl/d1_msg.c > $(OPENSSL_PATH)/ssl/d1_srtp.c > $(OPENSSL_PATH)/ssl/methods.c > + $(OPENSSL_PATH)/ssl/packet.c > $(OPENSSL_PATH)/ssl/pqueue.c > $(OPENSSL_PATH)/ssl/record/dtls1_bitmap.c > $(OPENSSL_PATH)/ssl/record/rec_layer_d1.c > $(OPENSSL_PATH)/ssl/record/rec_layer_s3.c > $(OPENSSL_PATH)/ssl/record/ssl3_buffer.c > $(OPENSSL_PATH)/ssl/record/ssl3_record.c > + $(OPENSSL_PATH)/ssl/record/ssl3_record_tls13.c > $(OPENSSL_PATH)/ssl/s3_cbc.c > $(OPENSSL_PATH)/ssl/s3_enc.c > $(OPENSSL_PATH)/ssl/s3_lib.c > @@ -502,25 +524,45 @@ [Sources] > $(OPENSSL_PATH)/ssl/ssl_stat.c > $(OPENSSL_PATH)/ssl/ssl_txt.c > $(OPENSSL_PATH)/ssl/ssl_utst.c > + $(OPENSSL_PATH)/ssl/statem/extensions.c > + $(OPENSSL_PATH)/ssl/statem/extensions_clnt.c > + $(OPENSSL_PATH)/ssl/statem/extensions_cust.c > + $(OPENSSL_PATH)/ssl/statem/extensions_srvr.c > $(OPENSSL_PATH)/ssl/statem/statem.c > $(OPENSSL_PATH)/ssl/statem/statem_clnt.c > $(OPENSSL_PATH)/ssl/statem/statem_dtls.c > $(OPENSSL_PATH)/ssl/statem/statem_lib.c > $(OPENSSL_PATH)/ssl/statem/statem_srvr.c > $(OPENSSL_PATH)/ssl/t1_enc.c > - $(OPENSSL_PATH)/ssl/t1_ext.c > $(OPENSSL_PATH)/ssl/t1_lib.c > - $(OPENSSL_PATH)/ssl/t1_reneg.c > $(OPENSSL_PATH)/ssl/t1_trce.c > + $(OPENSSL_PATH)/ssl/tls13_enc.c > $(OPENSSL_PATH)/ssl/tls_srp.c > # Autogenerated files list ends here > > + ossl_store.c > + rand_pool.c > + > +[Sources.Ia32] > + rand_pool_noise_tsc.c > + > +[Sources.X64] > + rand_pool_noise_tsc.c > + > +[Sources.ARM] > + rand_pool_noise.c > + > +[Sources.AARCH64] > + rand_pool_noise.c > + > [Packages] > MdePkg/MdePkg.dec > CryptoPkg/CryptoPkg.dec > > [LibraryClasses] > + BaseLib > DebugLib > + TimerLib > > [LibraryClasses.ARM] > ArmSoftFloatLib > diff --git a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf > index fd12d112edb2..49599a42d180 100644 > --- a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf > +++ b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf > @@ -1,7 +1,7 @@ > ## @file > # This module provides OpenSSL Library implementation. > # > -# Copyright (c) 2010 - 2018, Intel Corporation. All rights reserved.<BR> > +# Copyright (c) 2010 - 2019, Intel Corporation. All rights reserved.<BR> > # SPDX-License-Identifier: BSD-2-Clause-Patent > # > ## > @@ -15,7 +15,7 @@ [Defines] > VERSION_STRING = 1.0 > LIBRARY_CLASS = OpensslLib > DEFINE OPENSSL_PATH = openssl > - DEFINE OPENSSL_FLAGS = -DL_ENDIAN -DOPENSSL_SMALL_FOOTPRINT -D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECATE -DNO_SYSLOG > + DEFINE OPENSSL_FLAGS = -DL_ENDIAN -DOPENSSL_SMALL_FOOTPRINT -D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECATE > > # > # VALID_ARCHITECTURES = IA32 X64 ARM AARCH64 > @@ -32,6 +32,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/aes/aes_misc.c > $(OPENSSL_PATH)/crypto/aes/aes_ofb.c > $(OPENSSL_PATH)/crypto/aes/aes_wrap.c > + $(OPENSSL_PATH)/crypto/aria/aria.c > $(OPENSSL_PATH)/crypto/asn1/a_bitstr.c > $(OPENSSL_PATH)/crypto/asn1/a_d2i_fp.c > $(OPENSSL_PATH)/crypto/asn1/a_digest.c > @@ -54,6 +55,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/asn1/ameth_lib.c > $(OPENSSL_PATH)/crypto/asn1/asn1_err.c > $(OPENSSL_PATH)/crypto/asn1/asn1_gen.c > + $(OPENSSL_PATH)/crypto/asn1/asn1_item_list.c > $(OPENSSL_PATH)/crypto/asn1/asn1_lib.c > $(OPENSSL_PATH)/crypto/asn1/asn1_par.c > $(OPENSSL_PATH)/crypto/asn1/asn_mime.c > @@ -172,6 +174,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/conf/conf_ssl.c > $(OPENSSL_PATH)/crypto/cpt_err.c > $(OPENSSL_PATH)/crypto/cryptlib.c > + $(OPENSSL_PATH)/crypto/ctype.c > $(OPENSSL_PATH)/crypto/cversion.c > $(OPENSSL_PATH)/crypto/des/cbc_cksm.c > $(OPENSSL_PATH)/crypto/des/cbc_enc.c > @@ -189,7 +192,6 @@ [Sources] > $(OPENSSL_PATH)/crypto/des/pcbc_enc.c > $(OPENSSL_PATH)/crypto/des/qud_cksm.c > $(OPENSSL_PATH)/crypto/des/rand_key.c > - $(OPENSSL_PATH)/crypto/des/rpc_enc.c > $(OPENSSL_PATH)/crypto/des/set_key.c > $(OPENSSL_PATH)/crypto/des/str2key.c > $(OPENSSL_PATH)/crypto/des/xcbc_enc.c > @@ -206,6 +208,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/dh/dh_pmeth.c > $(OPENSSL_PATH)/crypto/dh/dh_prn.c > $(OPENSSL_PATH)/crypto/dh/dh_rfc5114.c > + $(OPENSSL_PATH)/crypto/dh/dh_rfc7919.c > $(OPENSSL_PATH)/crypto/dso/dso_dl.c > $(OPENSSL_PATH)/crypto/dso/dso_dlfcn.c > $(OPENSSL_PATH)/crypto/dso/dso_err.c > @@ -228,6 +231,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/evp/e_aes.c > $(OPENSSL_PATH)/crypto/evp/e_aes_cbc_hmac_sha1.c > $(OPENSSL_PATH)/crypto/evp/e_aes_cbc_hmac_sha256.c > + $(OPENSSL_PATH)/crypto/evp/e_aria.c > $(OPENSSL_PATH)/crypto/evp/e_bf.c > $(OPENSSL_PATH)/crypto/evp/e_camellia.c > $(OPENSSL_PATH)/crypto/evp/e_cast.c > @@ -242,6 +246,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/evp/e_rc4_hmac_md5.c > $(OPENSSL_PATH)/crypto/evp/e_rc5.c > $(OPENSSL_PATH)/crypto/evp/e_seed.c > + $(OPENSSL_PATH)/crypto/evp/e_sm4.c > $(OPENSSL_PATH)/crypto/evp/e_xcbc_d.c > $(OPENSSL_PATH)/crypto/evp/encode.c > $(OPENSSL_PATH)/crypto/evp/evp_cnf.c > @@ -259,6 +264,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/evp/m_null.c > $(OPENSSL_PATH)/crypto/evp/m_ripemd.c > $(OPENSSL_PATH)/crypto/evp/m_sha1.c > + $(OPENSSL_PATH)/crypto/evp/m_sha3.c > $(OPENSSL_PATH)/crypto/evp/m_sigver.c > $(OPENSSL_PATH)/crypto/evp/m_wp.c > $(OPENSSL_PATH)/crypto/evp/names.c > @@ -271,10 +277,10 @@ [Sources] > $(OPENSSL_PATH)/crypto/evp/p_seal.c > $(OPENSSL_PATH)/crypto/evp/p_sign.c > $(OPENSSL_PATH)/crypto/evp/p_verify.c > + $(OPENSSL_PATH)/crypto/evp/pbe_scrypt.c > $(OPENSSL_PATH)/crypto/evp/pmeth_fn.c > $(OPENSSL_PATH)/crypto/evp/pmeth_gn.c > $(OPENSSL_PATH)/crypto/evp/pmeth_lib.c > - $(OPENSSL_PATH)/crypto/evp/scrypt.c > $(OPENSSL_PATH)/crypto/ex_data.c > $(OPENSSL_PATH)/crypto/getenv.c > $(OPENSSL_PATH)/crypto/hmac/hm_ameth.c > @@ -283,6 +289,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/init.c > $(OPENSSL_PATH)/crypto/kdf/hkdf.c > $(OPENSSL_PATH)/crypto/kdf/kdf_err.c > + $(OPENSSL_PATH)/crypto/kdf/scrypt.c > $(OPENSSL_PATH)/crypto/kdf/tls1_prf.c > $(OPENSSL_PATH)/crypto/lhash/lh_stats.c > $(OPENSSL_PATH)/crypto/lhash/lhash.c > @@ -360,14 +367,14 @@ [Sources] > $(OPENSSL_PATH)/crypto/pkcs7/pk7_mime.c > $(OPENSSL_PATH)/crypto/pkcs7/pk7_smime.c > $(OPENSSL_PATH)/crypto/pkcs7/pkcs7err.c > - $(OPENSSL_PATH)/crypto/rand/md_rand.c > + $(OPENSSL_PATH)/crypto/rand/drbg_ctr.c > + $(OPENSSL_PATH)/crypto/rand/drbg_lib.c > $(OPENSSL_PATH)/crypto/rand/rand_egd.c > $(OPENSSL_PATH)/crypto/rand/rand_err.c > $(OPENSSL_PATH)/crypto/rand/rand_lib.c > $(OPENSSL_PATH)/crypto/rand/rand_unix.c > $(OPENSSL_PATH)/crypto/rand/rand_vms.c > $(OPENSSL_PATH)/crypto/rand/rand_win.c > - $(OPENSSL_PATH)/crypto/rand/randfile.c > $(OPENSSL_PATH)/crypto/rc4/rc4_enc.c > $(OPENSSL_PATH)/crypto/rc4/rc4_skey.c > $(OPENSSL_PATH)/crypto/rsa/rsa_ameth.c > @@ -379,8 +386,8 @@ [Sources] > $(OPENSSL_PATH)/crypto/rsa/rsa_gen.c > $(OPENSSL_PATH)/crypto/rsa/rsa_lib.c > $(OPENSSL_PATH)/crypto/rsa/rsa_meth.c > + $(OPENSSL_PATH)/crypto/rsa/rsa_mp.c > $(OPENSSL_PATH)/crypto/rsa/rsa_none.c > - $(OPENSSL_PATH)/crypto/rsa/rsa_null.c > $(OPENSSL_PATH)/crypto/rsa/rsa_oaep.c > $(OPENSSL_PATH)/crypto/rsa/rsa_ossl.c > $(OPENSSL_PATH)/crypto/rsa/rsa_pk1.c > @@ -392,15 +399,27 @@ [Sources] > $(OPENSSL_PATH)/crypto/rsa/rsa_ssl.c > $(OPENSSL_PATH)/crypto/rsa/rsa_x931.c > $(OPENSSL_PATH)/crypto/rsa/rsa_x931g.c > + $(OPENSSL_PATH)/crypto/sha/keccak1600.c > $(OPENSSL_PATH)/crypto/sha/sha1_one.c > $(OPENSSL_PATH)/crypto/sha/sha1dgst.c > $(OPENSSL_PATH)/crypto/sha/sha256.c > $(OPENSSL_PATH)/crypto/sha/sha512.c > + $(OPENSSL_PATH)/crypto/siphash/siphash.c > + $(OPENSSL_PATH)/crypto/siphash/siphash_ameth.c > + $(OPENSSL_PATH)/crypto/siphash/siphash_pmeth.c > + $(OPENSSL_PATH)/crypto/sm3/m_sm3.c > + $(OPENSSL_PATH)/crypto/sm3/sm3.c > + $(OPENSSL_PATH)/crypto/sm4/sm4.c > $(OPENSSL_PATH)/crypto/stack/stack.c > $(OPENSSL_PATH)/crypto/threads_none.c > $(OPENSSL_PATH)/crypto/threads_pthread.c > $(OPENSSL_PATH)/crypto/threads_win.c > $(OPENSSL_PATH)/crypto/txt_db/txt_db.c > + $(OPENSSL_PATH)/crypto/ui/ui_err.c > + $(OPENSSL_PATH)/crypto/ui/ui_lib.c > + $(OPENSSL_PATH)/crypto/ui/ui_null.c > + $(OPENSSL_PATH)/crypto/ui/ui_openssl.c > + $(OPENSSL_PATH)/crypto/ui/ui_util.c > $(OPENSSL_PATH)/crypto/uid.c > $(OPENSSL_PATH)/crypto/x509/by_dir.c > $(OPENSSL_PATH)/crypto/x509/by_file.c > @@ -445,6 +464,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/x509v3/pcy_node.c > $(OPENSSL_PATH)/crypto/x509v3/pcy_tree.c > $(OPENSSL_PATH)/crypto/x509v3/v3_addr.c > + $(OPENSSL_PATH)/crypto/x509v3/v3_admis.c > $(OPENSSL_PATH)/crypto/x509v3/v3_akey.c > $(OPENSSL_PATH)/crypto/x509v3/v3_akeya.c > $(OPENSSL_PATH)/crypto/x509v3/v3_alt.c > @@ -476,12 +496,29 @@ [Sources] > $(OPENSSL_PATH)/crypto/x509v3/v3err.c > # Autogenerated files list ends here > > + ossl_store.c > + rand_pool.c > + > +[Sources.Ia32] > + rand_pool_noise_tsc.c > + > +[Sources.X64] > + rand_pool_noise_tsc.c > + > +[Sources.ARM] > + rand_pool_noise.c > + > +[Sources.AARCH64] > + rand_pool_noise.c > + > [Packages] > MdePkg/MdePkg.dec > CryptoPkg/CryptoPkg.dec > > [LibraryClasses] > + BaseLib > DebugLib > + TimerLib > > [LibraryClasses.ARM] > ArmSoftFloatLib > diff --git a/CryptoPkg/Library/Include/CrtLibSupport.h b/CryptoPkg/Library/Include/CrtLibSupport.h > index b05c5d908ce2..5806f50f7485 100644 > --- a/CryptoPkg/Library/Include/CrtLibSupport.h > +++ b/CryptoPkg/Library/Include/CrtLibSupport.h > @@ -2,7 +2,7 @@ > Root include file of C runtime library to support building the third-party > cryptographic library. > > -Copyright (c) 2010 - 2017, Intel Corporation. All rights reserved.<BR> > +Copyright (c) 2010 - 2019, Intel Corporation. All rights reserved.<BR> > SPDX-License-Identifier: BSD-2-Clause-Patent > > **/ > @@ -21,6 +21,17 @@ SPDX-License-Identifier: BSD-2-Clause-Patent > #define MAX_STRING_SIZE 0x1000 > > // > +// We already have "no-ui" in out Configure invocation. > +// but the code still fails to compile. > +// Ref: https://github.com/openssl/openssl/issues/8904 > +// > +// This is defined in CRT library(stdio.h). > +// > +#ifndef BUFSIZ > +#define BUFSIZ 8192 > +#endif > + > +// > // OpenSSL relies on explicit configuration for word size in crypto/bn, > // but we want it to be automatically inferred from the target. So we > // bypass what's in <openssl/opensslconf.h> for OPENSSL_SYS_UEFI, and > diff --git a/CryptoPkg/Library/Include/openssl/opensslconf.h b/CryptoPkg/Library/Include/openssl/opensslconf.h > index 28dd9ab93c61..07fa2d3ce280 100644 > --- a/CryptoPkg/Library/Include/openssl/opensslconf.h > +++ b/CryptoPkg/Library/Include/openssl/opensslconf.h > @@ -10,6 +10,8 @@ > * https://www.openssl.org/source/license.html > */ > > +#include <openssl/opensslv.h> > + > #ifdef __cplusplus > extern "C" { > #endif > @@ -77,18 +79,21 @@ extern "C" { > #ifndef OPENSSL_NO_SEED > # define OPENSSL_NO_SEED > #endif > +#ifndef OPENSSL_NO_SM2 > +# define OPENSSL_NO_SM2 > +#endif > #ifndef OPENSSL_NO_SRP > # define OPENSSL_NO_SRP > #endif > #ifndef OPENSSL_NO_TS > # define OPENSSL_NO_TS > #endif > -#ifndef OPENSSL_NO_UI > -# define OPENSSL_NO_UI > -#endif > #ifndef OPENSSL_NO_WHIRLPOOL > # define OPENSSL_NO_WHIRLPOOL > #endif > +#ifndef OPENSSL_RAND_SEED_NONE > +# define OPENSSL_RAND_SEED_NONE > +#endif > #ifndef OPENSSL_NO_AFALGENG > # define OPENSSL_NO_AFALGENG > #endif > @@ -122,6 +127,9 @@ extern "C" { > #ifndef OPENSSL_NO_DEPRECATED > # define OPENSSL_NO_DEPRECATED > #endif > +#ifndef OPENSSL_NO_DEVCRYPTOENG > +# define OPENSSL_NO_DEVCRYPTOENG > +#endif > #ifndef OPENSSL_NO_DGRAM > # define OPENSSL_NO_DGRAM > #endif > @@ -155,6 +163,9 @@ extern "C" { > #ifndef OPENSSL_NO_ERR > # define OPENSSL_NO_ERR > #endif > +#ifndef OPENSSL_NO_EXTERNAL_TESTS > +# define OPENSSL_NO_EXTERNAL_TESTS > +#endif > #ifndef OPENSSL_NO_FILENAMES > # define OPENSSL_NO_FILENAMES > #endif > @@ -209,15 +220,24 @@ extern "C" { > #ifndef OPENSSL_NO_TESTS > # define OPENSSL_NO_TESTS > #endif > +#ifndef OPENSSL_NO_TLS1_3 > +# define OPENSSL_NO_TLS1_3 > +#endif > #ifndef OPENSSL_NO_UBSAN > # define OPENSSL_NO_UBSAN > #endif > +#ifndef OPENSSL_NO_UI_CONSOLE > +# define OPENSSL_NO_UI_CONSOLE > +#endif > #ifndef OPENSSL_NO_UNIT_TEST > # define OPENSSL_NO_UNIT_TEST > #endif > #ifndef OPENSSL_NO_WEAK_SSL_CIPHERS > # define OPENSSL_NO_WEAK_SSL_CIPHERS > #endif > +#ifndef OPENSSL_NO_DYNAMIC_ENGINE > +# define OPENSSL_NO_DYNAMIC_ENGINE > +#endif > #ifndef OPENSSL_NO_AFALGENG > # define OPENSSL_NO_AFALGENG > #endif > @@ -236,15 +256,11 @@ extern "C" { > * functions. > */ > #ifndef DECLARE_DEPRECATED > -# if defined(OPENSSL_NO_DEPRECATED) > -# define DECLARE_DEPRECATED(f) > -# else > -# define DECLARE_DEPRECATED(f) f; > -# ifdef __GNUC__ > -# if __GNUC__ > 3 || (__GNUC__ == 3 && __GNUC_MINOR__ > 0) > -# undef DECLARE_DEPRECATED > -# define DECLARE_DEPRECATED(f) f __attribute__ ((deprecated)); > -# endif > +# define DECLARE_DEPRECATED(f) f; > +# ifdef __GNUC__ > +# if __GNUC__ > 3 || (__GNUC__ == 3 && __GNUC_MINOR__ > 0) > +# undef DECLARE_DEPRECATED > +# define DECLARE_DEPRECATED(f) f __attribute__ ((deprecated)); > # endif > # endif > #endif > @@ -268,6 +284,18 @@ extern "C" { > # define OPENSSL_API_COMPAT OPENSSL_MIN_API > #endif > > +/* > + * Do not deprecate things to be deprecated in version 1.2.0 before the > + * OpenSSL version number matches. > + */ > +#if OPENSSL_VERSION_NUMBER < 0x10200000L > +# define DEPRECATEDIN_1_2_0(f) f; > +#elif OPENSSL_API_COMPAT < 0x10200000L > +# define DEPRECATEDIN_1_2_0(f) DECLARE_DEPRECATED(f) > +#else > +# define DEPRECATEDIN_1_2_0(f) > +#endif > + > #if OPENSSL_API_COMPAT < 0x10100000L > # define DEPRECATEDIN_1_1_0(f) DECLARE_DEPRECATED(f) > #else > @@ -286,8 +314,6 @@ extern "C" { > # define DEPRECATEDIN_0_9_8(f) > #endif > > - > - > /* Generate 80386 code? */ > #undef I386_ONLY > > diff --git a/CryptoPkg/Library/OpensslLib/buildinf.h b/CryptoPkg/Library/OpensslLib/buildinf.h > index c5ca293c729f..b840c8656a28 100644 > --- a/CryptoPkg/Library/OpensslLib/buildinf.h > +++ b/CryptoPkg/Library/OpensslLib/buildinf.h > @@ -1,2 +1,4 @@ > #define PLATFORM "UEFI" > #define DATE "Fri Dec 22 01:23:45 PDT 2017" > + > +const char * compiler_flags = "compiler: information not available from edk2"; > diff --git a/CryptoPkg/Library/OpensslLib/rand_pool_noise.h b/CryptoPkg/Library/OpensslLib/rand_pool_noise.h > new file mode 100644 > index 000000000000..75acc686a9f1 > --- /dev/null > +++ b/CryptoPkg/Library/OpensslLib/rand_pool_noise.h > @@ -0,0 +1,29 @@ > +/** @file > + Provide rand noise source. > + > +Copyright (c) 2019, Intel Corporation. All rights reserved.<BR> > +SPDX-License-Identifier: BSD-2-Clause-Patent > + > +**/ > + > +#ifndef __RAND_POOL_NOISE_H__ > +#define __RAND_POOL_NOISE_H__ > + > +#include <Uefi/UefiBaseType.h> > + > +/** > + Get 64-bit noise source. > + > + @param[out] Rand Buffer pointer to store 64-bit noise source > + > + @retval TRUE Get randomness successfully. > + @retval FALSE Failed to generate > +**/ > +BOOLEAN > +EFIAPI > +GetRandomNoise64 ( > + OUT UINT64 *Rand > + ); > + > + > +#endif // __RAND_POOL_NOISE_H__ > diff --git a/CryptoPkg/Library/OpensslLib/ossl_store.c b/CryptoPkg/Library/OpensslLib/ossl_store.c > new file mode 100644 > index 000000000000..29e1506048e3 > --- /dev/null > +++ b/CryptoPkg/Library/OpensslLib/ossl_store.c > @@ -0,0 +1,17 @@ > +/** @file > + Dummy implement ossl_store(Store retrieval functions) for UEFI. > + > +Copyright (c) 2019, Intel Corporation. All rights reserved.<BR> > +SPDX-License-Identifier: BSD-2-Clause-Patent > + > +**/ > + > +/* > + * This function is cleanup ossl store. > + * > + * Dummy Implement for UEFI > + */ > +void ossl_store_cleanup_int(void) > +{ > +} > + > diff --git a/CryptoPkg/Library/OpensslLib/rand_pool.c b/CryptoPkg/Library/OpensslLib/rand_pool.c > new file mode 100644 > index 000000000000..9d2a4ad13823 > --- /dev/null > +++ b/CryptoPkg/Library/OpensslLib/rand_pool.c > @@ -0,0 +1,316 @@ > +/** @file > + OpenSSL_1_1_1b doesn't implement rand_pool_* functions for UEFI. > + The file implement these functions. > + > +Copyright (c) 2019, Intel Corporation. All rights reserved.<BR> > +SPDX-License-Identifier: BSD-2-Clause-Patent > + > +**/ > + > +#include "internal/rand_int.h" > +#include <openssl/aes.h> > + > +#include <Uefi.h> > +#include <Library/TimerLib.h> > + > +#include "rand_pool_noise.h" > + > +/** > + Get some randomness from low-order bits of GetPerformanceCounter results. > + And combine them to the 64-bit value > + > + @param[out] Rand Buffer pointer to store the 64-bit random value. > + > + @retval TRUE Random number generated successfully. > + @retval FALSE Failed to generate. > +**/ > +STATIC > +BOOLEAN > +EFIAPI > +GetRandNoise64FromPerformanceCounter( > + OUT UINT64 *Rand > + ) > +{ > + UINT32 Index; > + UINT32 *RandPtr; > + > + if (NULL == Rand) { > + return FALSE; > + } > + > + RandPtr = (UINT32 *) Rand; > + > + for (Index = 0; Index < 2; Index ++) { > + *RandPtr = (UINT32) (GetPerformanceCounter () & 0xFF); > + MicroSecondDelay (10); > + RandPtr++; > + } > + > + return TRUE; > +} > + > +/** > + Calls RandomNumber64 to fill > + a buffer of arbitrary size with random bytes. > + > + @param[in] Length Size of the buffer, in bytes, to fill with. > + @param[out] RandBuffer Pointer to the buffer to store the random result. > + > + @retval EFI_SUCCESS Random bytes generation succeeded. > + @retval EFI_NOT_READY Failed to request random bytes. > + > +**/ > +STATIC > +BOOLEAN > +EFIAPI > +RandGetBytes ( > + IN UINTN Length, > + OUT UINT8 *RandBuffer > + ) > +{ > + BOOLEAN Ret; > + UINT64 TempRand; > + > + Ret = FALSE; > + > + while (Length > 0) { > + // > + // Get random noise from platform. > + // If it failed, fallback to PerformanceCounter > + // If you really care about security, you must override > + // GetRandomNoise64FromPlatform. > + // > + Ret = GetRandomNoise64 (&TempRand); > + if (Ret == FALSE) { > + Ret = GetRandNoise64FromPerformanceCounter (&TempRand); > + } > + if (!Ret) { > + return Ret; > + } > + if (Length >= sizeof (TempRand)) { > + *((UINT64*) RandBuffer) = TempRand; > + RandBuffer += sizeof (UINT64); > + Length -= sizeof (TempRand); > + } else { > + CopyMem (RandBuffer, &TempRand, Length); > + Length = 0; > + } > + } > + > + return Ret; > +} > + > +/** > + Creates a 128bit random value that is fully forward and backward prediction resistant, > + suitable for seeding a NIST SP800-90 Compliant. > + This function takes multiple random numbers from PerformanceCounter to ensure reseeding > + and performs AES-CBC-MAC over the data to compute the seed value. > + > + @param[out] SeedBuffer Pointer to a 128bit buffer to store the random seed. > + > + @retval TRUE Random seed generation succeeded. > + @retval FALSE Failed to request random bytes. > + > +**/ > +STATIC > +BOOLEAN > +EFIAPI > +RandGetSeed128 ( > + OUT UINT8 *SeedBuffer > + ) > +{ > + BOOLEAN Ret; > + UINT8 RandByte[16]; > + UINT8 Key[16]; > + UINT8 Ffv[16]; > + UINT8 Xored[16]; > + UINT32 Index; > + UINT32 Index2; > + AES_KEY AESKey; > + > + // > + // Chose an arbitary key and zero the feed_forward_value (FFV) > + // > + for (Index = 0; Index < 16; Index++) { > + Key[Index] = (UINT8) Index; > + Ffv[Index] = 0; > + } > + > + AES_set_encrypt_key (Key, 16 * 8, &AESKey); > + > + // > + // Perform CBC_MAC over 32 * 128 bit values, with 10us gaps between 128 bit value > + // The 10us gaps will ensure multiple reseeds within the system time with a large > + // design margin. > + // > + for (Index = 0; Index < 32; Index++) { > + MicroSecondDelay (10); > + Ret = RandGetBytes (16, RandByte); > + if (!Ret) { > + return Ret; > + } > + > + // > + // Perform XOR operations on two 128-bit value. > + // > + for (Index2 = 0; Index2 < 16; Index2++) { > + Xored[Index2] = RandByte[Index2] ^ Ffv[Index2]; > + } > + > + AES_encrypt (Xored, Ffv, &AESKey); > + } > + > + for (Index = 0; Index < 16; Index++) { > + SeedBuffer[Index] = Ffv[Index]; > + } > + > + return Ret; > +} > + > +/** > + Generate high-quality entropy source. > + > + @param[in] Length Size of the buffer, in bytes, to fill with. > + @param[out] Entropy Pointer to the buffer to store the entropy data. > + > + @retval EFI_SUCCESS Entropy generation succeeded. > + @retval EFI_NOT_READY Failed to request random data. > + > +**/ > +STATIC > +BOOLEAN > +EFIAPI > +RandGenerateEntropy ( > + IN UINTN Length, > + OUT UINT8 *Entropy > + ) > +{ > + BOOLEAN Ret; > + UINTN BlockCount; > + UINT8 Seed[16]; > + UINT8 *Ptr; > + > + BlockCount = Length / 16; > + Ptr = (UINT8 *) Entropy; > + > + // > + // Generate high-quality seed for DRBG Entropy > + // > + while (BlockCount > 0) { > + Ret = RandGetSeed128 (Seed); > + if (!Ret) { > + return Ret; > + } > + CopyMem (Ptr, Seed, 16); > + > + BlockCount--; > + Ptr = Ptr + 16; > + } > + > + // > + // Populate the remained data as request. > + // > + Ret = RandGetSeed128 (Seed); > + if (!Ret) { > + return Ret; > + } > + CopyMem (Ptr, Seed, (Length % 16)); > + > + return Ret; > +} > + > +/* > + * Add random bytes to the pool to acquire requested amount of entropy > + * > + * This function is platform specific and tries to acquire the requested > + * amount of entropy by polling platform specific entropy sources. > + * > + * This is OpenSSL required interface. > + */ > +size_t rand_pool_acquire_entropy(RAND_POOL *pool) > +{ > + BOOLEAN Ret; > + size_t bytes_needed; > + unsigned char * buffer; > + > + bytes_needed = rand_pool_bytes_needed(pool, 1 /*entropy_factor*/); > + if (bytes_needed > 0) { > + buffer = rand_pool_add_begin(pool, bytes_needed); > + > + if (buffer != NULL) { > + Ret = RandGenerateEntropy(bytes_needed, buffer); > + if (FALSE == Ret) { > + rand_pool_add_end(pool, 0, 0); > + } else { > + rand_pool_add_end(pool, bytes_needed, 8 * bytes_needed); > + } > + } > + } > + > + return rand_pool_entropy_available(pool); > +} > + > +/* > + * Implementation for UEFI > + * > + * This is OpenSSL required interface. > + */ > +int rand_pool_add_nonce_data(RAND_POOL *pool) > +{ > + struct { > + UINT64 Rand; > + UINT64 TimerValue; > + } data = { 0 }; > + > + RandGetBytes(8, (UINT8 *)&(data.Rand)); > + data.TimerValue = GetPerformanceCounter(); > + > + return rand_pool_add(pool, (unsigned char*)&data, sizeof(data), 0); > +} > + > +/* > + * Implementation for UEFI > + * > + * This is OpenSSL required interface. > + */ > +int rand_pool_add_additional_data(RAND_POOL *pool) > +{ > + struct { > + UINT64 Rand; > + UINT64 TimerValue; > + } data = { 0 }; > + > + RandGetBytes(8, (UINT8 *)&(data.Rand)); > + data.TimerValue = GetPerformanceCounter(); > + > + return rand_pool_add(pool, (unsigned char*)&data, sizeof(data), 0); > +} > + > +/* > + * Dummy Implememtation for UEFI > + * > + * This is OpenSSL required interface. > + */ > +int rand_pool_init(void) > +{ > + return 1; > +} > + > +/* > + * Dummy Implememtation for UEFI > + * > + * This is OpenSSL required interface. > + */ > +void rand_pool_cleanup(void) > +{ > +} > + > +/* > + * Dummy Implememtation for UEFI > + * > + * This is OpenSSL required interface. > + */ > +void rand_pool_keep_random_devices_open(int keep) > +{ > +} > + > diff --git a/CryptoPkg/Library/OpensslLib/rand_pool_noise.c b/CryptoPkg/Library/OpensslLib/rand_pool_noise.c > new file mode 100644 > index 000000000000..c16ed8b45496 > --- /dev/null > +++ b/CryptoPkg/Library/OpensslLib/rand_pool_noise.c > @@ -0,0 +1,29 @@ > +/** @file > + Provide rand noise source. > + > +Copyright (c) 2019, Intel Corporation. All rights reserved.<BR> > +SPDX-License-Identifier: BSD-2-Clause-Patent > + > +**/ > + > +#include <Library/BaseLib.h> > + > +/** > + Get 64-bit noise source > + > + @param[out] Rand Buffer pointer to store 64-bit noise source > + > + @retval FALSE Failed to generate > +**/ > +BOOLEAN > +EFIAPI > +GetRandomNoise64 ( > + OUT UINT64 *Rand > + ) > +{ > + // > + // Return FALSE will fallback to use PerformaceCounter to > + // generate noise. > + // > + return FALSE; > +} > diff --git a/CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c b/CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c > new file mode 100644 > index 000000000000..4158106231fd > --- /dev/null > +++ b/CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c > @@ -0,0 +1,43 @@ > +/** @file > + Provide rand noise source. > + > +Copyright (c) 2019, Intel Corporation. All rights reserved.<BR> > +SPDX-License-Identifier: BSD-2-Clause-Patent > + > +**/ > + > +#include <Library/BaseLib.h> > +#include <Library/DebugLib.h> > +#include <Library/TimerLib.h> > + > +/** > + Get 64-bit noise source > + > + @param[out] Rand Buffer pointer to store 64-bit noise source > + > + @retval TRUE Get randomness successfully. > + @retval FALSE Failed to generate > +**/ > +BOOLEAN > +EFIAPI > +GetRandomNoise64 ( > + OUT UINT64 *Rand > + ) > +{ > + UINT32 Index; > + UINT32 *RandPtr; > + > + if (NULL == Rand) { > + return FALSE; > + } > + > + RandPtr = (UINT32 *)Rand; > + > + for (Index = 0; Index < 2; Index ++) { > + *RandPtr = (UINT32) ((AsmReadTsc ()) & 0xFF); > + RandPtr++; > + MicroSecondDelay (10); > + } > + > + return TRUE; > +} > diff --git a/CryptoPkg/Library/OpensslLib/openssl b/CryptoPkg/Library/OpensslLib/openssl > index 74f2d9c1ec5f..50eaac9f3337 160000 > --- a/CryptoPkg/Library/OpensslLib/openssl > +++ b/CryptoPkg/Library/OpensslLib/openssl > @@ -1 +1 @@ > -Subproject commit 74f2d9c1ec5f5510e1d3da5a9f03c28df0977762 > +Subproject commit 50eaac9f3337667259de725451f201e784599687 > ^ permalink raw reply [flat|nested] 39+ messages in thread
* Re: [edk2-devel] [PATCH v4 6/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b 2019-05-16 16:31 ` [edk2-devel] " Laszlo Ersek @ 2019-05-17 11:14 ` Xiaoyu Lu 2019-05-17 13:15 ` Laszlo Ersek 0 siblings, 1 reply; 39+ messages in thread From: Xiaoyu Lu @ 2019-05-17 11:14 UTC (permalink / raw) To: Laszlo Ersek, devel@edk2.groups.io, Wang, Jian J; +Cc: Ye, Ting Laszlo, I think (b) is better and have already done this. About (b/1): One the one hand, the implementation still need discuss later. On the other hand: Refer to openssl/INSTALL the meaning of --with-rand-seed=none > none: Disable automatic seeding. This is the default > on some operating systems where no suitable > entropy source exists, or no support for it is > implemented yet. I think when --with-rand-seed=none option is set, the best way to implement rand_pool_acquire_entropy should like this: >size_t rand_pool_acquire_entropy(RAND_POOL *pool) >{ > return rand_pool_entropy_available(pool); >} > >int rand_pool_add_nonce_data(RAND_POOL *pool) >{ > // I think PerformanceCounter is an optional nonce. > UINT64 data; > data = GetPerformanceCounter(); > > return rand_pool_add(pool, (unsigned char*)&data, sizeof(data), 0);>} > >int rand_pool_add_additional_data(RAND_POOL *pool) >{ > return 0; >} With this, we handed the Rand_seed work to caller. (caller must provide safe seed). What do you think? Thanks, Xiaoyu -----Original Message----- From: Laszlo Ersek [mailto:lersek@redhat.com] Sent: Friday, May 17, 2019 12:32 AM To: devel@edk2.groups.io; Lu, XiaoyuX <xiaoyux.lu@intel.com>; Wang, Jian J <jian.j.wang@intel.com> Cc: Ye, Ting <ting.ye@intel.com> Subject: Re: [edk2-devel] [PATCH v4 6/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b Hi Jian, On 05/16/19 09:54, Xiaoyu lu wrote: > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1089 > > * Update OpenSSL submodule to OpenSSL_1_1_1b > OpenSSL_1_1_1b(50eaac9f3337667259de725451f201e784599687) > > * Run process_files.pl script to regenerate OpensslLib[Crypto].inf > and opensslconf.h > > * Remove -DNO_SYSLOG from OPENSSL_FLAGS in OpensslLib[Crypto].inf, > due to upstream OpenSSL commit cff55b90e95e("Cleaning UEFI > Build with additional OPENSSL_SYS_UEFI flags", 2017-03-29), > which was first released as part of OpenSSL_1_1_1. > > * Starting with OpenSSL commit 8a8d9e1905(first release in > OpenSSL_1_1_1), the OpenSSL_version() function can no longer > return a pointer to the string literal "compiler: information > not available", in the case CFLAGS macro is not defined. > Instead, the function now has a hard dependency on the global > variable 'compiler_flags'. This variable is normally placed > by "util/mkbuildinf.pl" into "buildinf.h". In edk2 we don't > run that script whenever we build OpenSSL, therefore we > must provide our own dummy 'compiler_flags'. > > * From OpenSSL_1_1_0i(97c0959f27b294fe1eb10b547145ebef2524b896) to > OpenSSL_1_1_1b(50eaac9f3337667259de725451f201e784599687), OpenSSL > updated DRBG / RAND to request nonce and additional low entropy > randomness from system(line 229 openssl/CHANGES). > > Since OpenSSL_1_1_1b doesn't fully implement rand pool functions > for UEFI. We must provide a method to implenet these method. > TSC is used as first entropy source if it's availabe otherwise > fallback to TimerLib. But we are not sure the amount of randomness > they provide. If you really care about the security, one choice is > overrided it with hardware generator. > > Add rand_pool.c to implement these functions required by OpenSSL > rand_pool_acquire_entropy > rand_pool_add_nonce_data > rand_pool_add_additional_data > rand_pool_init > rand_pool_cleanup > rand_pool_keep_random_devices_open > > And add rand_pool_noise.* for getting entropy noise from different > architecture. > > * We don't need ossl_store functions. We exclude relative files > through process_files.pl. And ossl_store_cleanup_int was first > added in crypto/init.c OpenSSL_1_1_1(71a5516d). > So add a new file(ossl_store.c) to implement ossl_store_cleanup_int > function. > > * BUFSIZ is used by crypto/evp/evp_key.c(OpenSSL_1_1_1b) > And it is declared in stdio.h. So add it to CrtLibSupport.h. > Here's a discussion about this. > Ref: https://github.com/openssl/openssl/issues/8904 > > Cc: Jian J Wang <jian.j.wang@intel.com> > Cc: Ting Ye <ting.ye@intel.com> > Signed-off-by: Xiaoyu Lu <xiaoyux.lu@intel.com> > --- > CryptoPkg/Library/OpensslLib/OpensslLib.inf | 60 +++- > CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 51 +++- > CryptoPkg/Library/Include/CrtLibSupport.h | 13 +- > CryptoPkg/Library/Include/openssl/opensslconf.h | 54 +++- > CryptoPkg/Library/OpensslLib/buildinf.h | 2 + > CryptoPkg/Library/OpensslLib/rand_pool_noise.h | 29 ++ > CryptoPkg/Library/OpensslLib/ossl_store.c | 17 ++ > CryptoPkg/Library/OpensslLib/rand_pool.c | 316 +++++++++++++++++++++ > CryptoPkg/Library/OpensslLib/rand_pool_noise.c | 29 ++ > CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c | 43 +++ > CryptoPkg/Library/OpensslLib/openssl | 2 +- > 11 files changed, 584 insertions(+), 32 deletions(-) create mode > 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.h > create mode 100644 CryptoPkg/Library/OpensslLib/ossl_store.c > create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool.c > create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.c > create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c For this patch, I can offer two kinds of reviews: ---*--- (a) If you prefer to push this patch in the present form (that is, exactly as posted), then I will not give any official feedback tags, due to the crypto contents. I will not block the patch either, so if you and Ting are fine with the patch, it's OK for you to push it, from my side. ---*--- (b) Alternatively, you could split the patch in two halves, as follows: (b/1) In the first half, collect all the hunks for the following files: CryptoPkg/Library/OpensslLib/ossl_store.c CryptoPkg/Library/OpensslLib/rand_pool.c CryptoPkg/Library/OpensslLib/rand_pool_noise.c CryptoPkg/Library/OpensslLib/rand_pool_noise.h CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c plus include the commit message paragraphs about "rand_pool.c" and "ossl_store.c". For this half (b/1), I will not give any feedback. (b/2) In the second half, collect the rest of the changes, that is, the hunks for the following files / submodules, and the rest of the commit message: CryptoPkg/Library/Include/CrtLibSupport.h CryptoPkg/Library/Include/openssl/opensslconf.h CryptoPkg/Library/OpensslLib/OpensslLib.inf CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf CryptoPkg/Library/OpensslLib/buildinf.h CryptoPkg/Library/OpensslLib/openssl For the (b/2) half *ONLY*, you can add: Reviewed-by: Laszlo Ersek <lersek@redhat.com> ---*--- It's up to you whether you pick (a) or (b). Normally I would request a v5 series for implementing (b), but we're out of time. If the community thinks that splitting up this patch into halves (b/1) and (b/2) is too intrusive for a maintainer to do without proper review, then I suggest going with (a) -- and then I'll provide no feedback tags. (But, I will also not block the patch, see above.) ... Well, in theory anyway, Xiaoyu could very quickly submit a v5 series, splitting this patch as explained under (b). In that case, the (b/2) half -- and *ONLY* that half -- of this patch could include my R-b at once. So, please decide. Thanks! Laszlo > > diff --git a/CryptoPkg/Library/OpensslLib/OpensslLib.inf > b/CryptoPkg/Library/OpensslLib/OpensslLib.inf > index f4d7772c068c..62dd61969cb0 100644 > --- a/CryptoPkg/Library/OpensslLib/OpensslLib.inf > +++ b/CryptoPkg/Library/OpensslLib/OpensslLib.inf > @@ -1,7 +1,7 @@ > ## @file > # This module provides OpenSSL Library implementation. > # > -# Copyright (c) 2010 - 2018, Intel Corporation. All rights > reserved.<BR> > +# Copyright (c) 2010 - 2019, Intel Corporation. All rights > +reserved.<BR> > # SPDX-License-Identifier: BSD-2-Clause-Patent # ## @@ -15,7 +15,7 > @@ [Defines] > VERSION_STRING = 1.0 > LIBRARY_CLASS = OpensslLib > DEFINE OPENSSL_PATH = openssl > - DEFINE OPENSSL_FLAGS = -DL_ENDIAN -DOPENSSL_SMALL_FOOTPRINT -D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECATE -DNO_SYSLOG > + DEFINE OPENSSL_FLAGS = -DL_ENDIAN -DOPENSSL_SMALL_FOOTPRINT -D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECATE > > # > # VALID_ARCHITECTURES = IA32 X64 ARM AARCH64 > @@ -32,6 +32,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/aes/aes_misc.c > $(OPENSSL_PATH)/crypto/aes/aes_ofb.c > $(OPENSSL_PATH)/crypto/aes/aes_wrap.c > + $(OPENSSL_PATH)/crypto/aria/aria.c > $(OPENSSL_PATH)/crypto/asn1/a_bitstr.c > $(OPENSSL_PATH)/crypto/asn1/a_d2i_fp.c > $(OPENSSL_PATH)/crypto/asn1/a_digest.c > @@ -54,6 +55,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/asn1/ameth_lib.c > $(OPENSSL_PATH)/crypto/asn1/asn1_err.c > $(OPENSSL_PATH)/crypto/asn1/asn1_gen.c > + $(OPENSSL_PATH)/crypto/asn1/asn1_item_list.c > $(OPENSSL_PATH)/crypto/asn1/asn1_lib.c > $(OPENSSL_PATH)/crypto/asn1/asn1_par.c > $(OPENSSL_PATH)/crypto/asn1/asn_mime.c > @@ -172,6 +174,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/conf/conf_ssl.c > $(OPENSSL_PATH)/crypto/cpt_err.c > $(OPENSSL_PATH)/crypto/cryptlib.c > + $(OPENSSL_PATH)/crypto/ctype.c > $(OPENSSL_PATH)/crypto/cversion.c > $(OPENSSL_PATH)/crypto/des/cbc_cksm.c > $(OPENSSL_PATH)/crypto/des/cbc_enc.c > @@ -189,7 +192,6 @@ [Sources] > $(OPENSSL_PATH)/crypto/des/pcbc_enc.c > $(OPENSSL_PATH)/crypto/des/qud_cksm.c > $(OPENSSL_PATH)/crypto/des/rand_key.c > - $(OPENSSL_PATH)/crypto/des/rpc_enc.c > $(OPENSSL_PATH)/crypto/des/set_key.c > $(OPENSSL_PATH)/crypto/des/str2key.c > $(OPENSSL_PATH)/crypto/des/xcbc_enc.c > @@ -206,6 +208,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/dh/dh_pmeth.c > $(OPENSSL_PATH)/crypto/dh/dh_prn.c > $(OPENSSL_PATH)/crypto/dh/dh_rfc5114.c > + $(OPENSSL_PATH)/crypto/dh/dh_rfc7919.c > $(OPENSSL_PATH)/crypto/dso/dso_dl.c > $(OPENSSL_PATH)/crypto/dso/dso_dlfcn.c > $(OPENSSL_PATH)/crypto/dso/dso_err.c > @@ -228,6 +231,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/evp/e_aes.c > $(OPENSSL_PATH)/crypto/evp/e_aes_cbc_hmac_sha1.c > $(OPENSSL_PATH)/crypto/evp/e_aes_cbc_hmac_sha256.c > + $(OPENSSL_PATH)/crypto/evp/e_aria.c > $(OPENSSL_PATH)/crypto/evp/e_bf.c > $(OPENSSL_PATH)/crypto/evp/e_camellia.c > $(OPENSSL_PATH)/crypto/evp/e_cast.c > @@ -242,6 +246,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/evp/e_rc4_hmac_md5.c > $(OPENSSL_PATH)/crypto/evp/e_rc5.c > $(OPENSSL_PATH)/crypto/evp/e_seed.c > + $(OPENSSL_PATH)/crypto/evp/e_sm4.c > $(OPENSSL_PATH)/crypto/evp/e_xcbc_d.c > $(OPENSSL_PATH)/crypto/evp/encode.c > $(OPENSSL_PATH)/crypto/evp/evp_cnf.c > @@ -259,6 +264,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/evp/m_null.c > $(OPENSSL_PATH)/crypto/evp/m_ripemd.c > $(OPENSSL_PATH)/crypto/evp/m_sha1.c > + $(OPENSSL_PATH)/crypto/evp/m_sha3.c > $(OPENSSL_PATH)/crypto/evp/m_sigver.c > $(OPENSSL_PATH)/crypto/evp/m_wp.c > $(OPENSSL_PATH)/crypto/evp/names.c > @@ -271,10 +277,10 @@ [Sources] > $(OPENSSL_PATH)/crypto/evp/p_seal.c > $(OPENSSL_PATH)/crypto/evp/p_sign.c > $(OPENSSL_PATH)/crypto/evp/p_verify.c > + $(OPENSSL_PATH)/crypto/evp/pbe_scrypt.c > $(OPENSSL_PATH)/crypto/evp/pmeth_fn.c > $(OPENSSL_PATH)/crypto/evp/pmeth_gn.c > $(OPENSSL_PATH)/crypto/evp/pmeth_lib.c > - $(OPENSSL_PATH)/crypto/evp/scrypt.c > $(OPENSSL_PATH)/crypto/ex_data.c > $(OPENSSL_PATH)/crypto/getenv.c > $(OPENSSL_PATH)/crypto/hmac/hm_ameth.c > @@ -283,6 +289,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/init.c > $(OPENSSL_PATH)/crypto/kdf/hkdf.c > $(OPENSSL_PATH)/crypto/kdf/kdf_err.c > + $(OPENSSL_PATH)/crypto/kdf/scrypt.c > $(OPENSSL_PATH)/crypto/kdf/tls1_prf.c > $(OPENSSL_PATH)/crypto/lhash/lh_stats.c > $(OPENSSL_PATH)/crypto/lhash/lhash.c > @@ -360,14 +367,14 @@ [Sources] > $(OPENSSL_PATH)/crypto/pkcs7/pk7_mime.c > $(OPENSSL_PATH)/crypto/pkcs7/pk7_smime.c > $(OPENSSL_PATH)/crypto/pkcs7/pkcs7err.c > - $(OPENSSL_PATH)/crypto/rand/md_rand.c > + $(OPENSSL_PATH)/crypto/rand/drbg_ctr.c > + $(OPENSSL_PATH)/crypto/rand/drbg_lib.c > $(OPENSSL_PATH)/crypto/rand/rand_egd.c > $(OPENSSL_PATH)/crypto/rand/rand_err.c > $(OPENSSL_PATH)/crypto/rand/rand_lib.c > $(OPENSSL_PATH)/crypto/rand/rand_unix.c > $(OPENSSL_PATH)/crypto/rand/rand_vms.c > $(OPENSSL_PATH)/crypto/rand/rand_win.c > - $(OPENSSL_PATH)/crypto/rand/randfile.c > $(OPENSSL_PATH)/crypto/rc4/rc4_enc.c > $(OPENSSL_PATH)/crypto/rc4/rc4_skey.c > $(OPENSSL_PATH)/crypto/rsa/rsa_ameth.c > @@ -379,8 +386,8 @@ [Sources] > $(OPENSSL_PATH)/crypto/rsa/rsa_gen.c > $(OPENSSL_PATH)/crypto/rsa/rsa_lib.c > $(OPENSSL_PATH)/crypto/rsa/rsa_meth.c > + $(OPENSSL_PATH)/crypto/rsa/rsa_mp.c > $(OPENSSL_PATH)/crypto/rsa/rsa_none.c > - $(OPENSSL_PATH)/crypto/rsa/rsa_null.c > $(OPENSSL_PATH)/crypto/rsa/rsa_oaep.c > $(OPENSSL_PATH)/crypto/rsa/rsa_ossl.c > $(OPENSSL_PATH)/crypto/rsa/rsa_pk1.c > @@ -392,15 +399,27 @@ [Sources] > $(OPENSSL_PATH)/crypto/rsa/rsa_ssl.c > $(OPENSSL_PATH)/crypto/rsa/rsa_x931.c > $(OPENSSL_PATH)/crypto/rsa/rsa_x931g.c > + $(OPENSSL_PATH)/crypto/sha/keccak1600.c > $(OPENSSL_PATH)/crypto/sha/sha1_one.c > $(OPENSSL_PATH)/crypto/sha/sha1dgst.c > $(OPENSSL_PATH)/crypto/sha/sha256.c > $(OPENSSL_PATH)/crypto/sha/sha512.c > + $(OPENSSL_PATH)/crypto/siphash/siphash.c > + $(OPENSSL_PATH)/crypto/siphash/siphash_ameth.c > + $(OPENSSL_PATH)/crypto/siphash/siphash_pmeth.c > + $(OPENSSL_PATH)/crypto/sm3/m_sm3.c > + $(OPENSSL_PATH)/crypto/sm3/sm3.c > + $(OPENSSL_PATH)/crypto/sm4/sm4.c > $(OPENSSL_PATH)/crypto/stack/stack.c > $(OPENSSL_PATH)/crypto/threads_none.c > $(OPENSSL_PATH)/crypto/threads_pthread.c > $(OPENSSL_PATH)/crypto/threads_win.c > $(OPENSSL_PATH)/crypto/txt_db/txt_db.c > + $(OPENSSL_PATH)/crypto/ui/ui_err.c > + $(OPENSSL_PATH)/crypto/ui/ui_lib.c > + $(OPENSSL_PATH)/crypto/ui/ui_null.c > + $(OPENSSL_PATH)/crypto/ui/ui_openssl.c > + $(OPENSSL_PATH)/crypto/ui/ui_util.c > $(OPENSSL_PATH)/crypto/uid.c > $(OPENSSL_PATH)/crypto/x509/by_dir.c > $(OPENSSL_PATH)/crypto/x509/by_file.c > @@ -445,6 +464,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/x509v3/pcy_node.c > $(OPENSSL_PATH)/crypto/x509v3/pcy_tree.c > $(OPENSSL_PATH)/crypto/x509v3/v3_addr.c > + $(OPENSSL_PATH)/crypto/x509v3/v3_admis.c > $(OPENSSL_PATH)/crypto/x509v3/v3_akey.c > $(OPENSSL_PATH)/crypto/x509v3/v3_akeya.c > $(OPENSSL_PATH)/crypto/x509v3/v3_alt.c > @@ -479,12 +499,14 @@ [Sources] > $(OPENSSL_PATH)/ssl/d1_msg.c > $(OPENSSL_PATH)/ssl/d1_srtp.c > $(OPENSSL_PATH)/ssl/methods.c > + $(OPENSSL_PATH)/ssl/packet.c > $(OPENSSL_PATH)/ssl/pqueue.c > $(OPENSSL_PATH)/ssl/record/dtls1_bitmap.c > $(OPENSSL_PATH)/ssl/record/rec_layer_d1.c > $(OPENSSL_PATH)/ssl/record/rec_layer_s3.c > $(OPENSSL_PATH)/ssl/record/ssl3_buffer.c > $(OPENSSL_PATH)/ssl/record/ssl3_record.c > + $(OPENSSL_PATH)/ssl/record/ssl3_record_tls13.c > $(OPENSSL_PATH)/ssl/s3_cbc.c > $(OPENSSL_PATH)/ssl/s3_enc.c > $(OPENSSL_PATH)/ssl/s3_lib.c > @@ -502,25 +524,45 @@ [Sources] > $(OPENSSL_PATH)/ssl/ssl_stat.c > $(OPENSSL_PATH)/ssl/ssl_txt.c > $(OPENSSL_PATH)/ssl/ssl_utst.c > + $(OPENSSL_PATH)/ssl/statem/extensions.c > + $(OPENSSL_PATH)/ssl/statem/extensions_clnt.c > + $(OPENSSL_PATH)/ssl/statem/extensions_cust.c > + $(OPENSSL_PATH)/ssl/statem/extensions_srvr.c > $(OPENSSL_PATH)/ssl/statem/statem.c > $(OPENSSL_PATH)/ssl/statem/statem_clnt.c > $(OPENSSL_PATH)/ssl/statem/statem_dtls.c > $(OPENSSL_PATH)/ssl/statem/statem_lib.c > $(OPENSSL_PATH)/ssl/statem/statem_srvr.c > $(OPENSSL_PATH)/ssl/t1_enc.c > - $(OPENSSL_PATH)/ssl/t1_ext.c > $(OPENSSL_PATH)/ssl/t1_lib.c > - $(OPENSSL_PATH)/ssl/t1_reneg.c > $(OPENSSL_PATH)/ssl/t1_trce.c > + $(OPENSSL_PATH)/ssl/tls13_enc.c > $(OPENSSL_PATH)/ssl/tls_srp.c > # Autogenerated files list ends here > > + ossl_store.c > + rand_pool.c > + > +[Sources.Ia32] > + rand_pool_noise_tsc.c > + > +[Sources.X64] > + rand_pool_noise_tsc.c > + > +[Sources.ARM] > + rand_pool_noise.c > + > +[Sources.AARCH64] > + rand_pool_noise.c > + > [Packages] > MdePkg/MdePkg.dec > CryptoPkg/CryptoPkg.dec > > [LibraryClasses] > + BaseLib > DebugLib > + TimerLib > > [LibraryClasses.ARM] > ArmSoftFloatLib > diff --git a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf > b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf > index fd12d112edb2..49599a42d180 100644 > --- a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf > +++ b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf > @@ -1,7 +1,7 @@ > ## @file > # This module provides OpenSSL Library implementation. > # > -# Copyright (c) 2010 - 2018, Intel Corporation. All rights > reserved.<BR> > +# Copyright (c) 2010 - 2019, Intel Corporation. All rights > +reserved.<BR> > # SPDX-License-Identifier: BSD-2-Clause-Patent # ## @@ -15,7 +15,7 > @@ [Defines] > VERSION_STRING = 1.0 > LIBRARY_CLASS = OpensslLib > DEFINE OPENSSL_PATH = openssl > - DEFINE OPENSSL_FLAGS = -DL_ENDIAN -DOPENSSL_SMALL_FOOTPRINT -D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECATE -DNO_SYSLOG > + DEFINE OPENSSL_FLAGS = -DL_ENDIAN -DOPENSSL_SMALL_FOOTPRINT -D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECATE > > # > # VALID_ARCHITECTURES = IA32 X64 ARM AARCH64 > @@ -32,6 +32,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/aes/aes_misc.c > $(OPENSSL_PATH)/crypto/aes/aes_ofb.c > $(OPENSSL_PATH)/crypto/aes/aes_wrap.c > + $(OPENSSL_PATH)/crypto/aria/aria.c > $(OPENSSL_PATH)/crypto/asn1/a_bitstr.c > $(OPENSSL_PATH)/crypto/asn1/a_d2i_fp.c > $(OPENSSL_PATH)/crypto/asn1/a_digest.c > @@ -54,6 +55,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/asn1/ameth_lib.c > $(OPENSSL_PATH)/crypto/asn1/asn1_err.c > $(OPENSSL_PATH)/crypto/asn1/asn1_gen.c > + $(OPENSSL_PATH)/crypto/asn1/asn1_item_list.c > $(OPENSSL_PATH)/crypto/asn1/asn1_lib.c > $(OPENSSL_PATH)/crypto/asn1/asn1_par.c > $(OPENSSL_PATH)/crypto/asn1/asn_mime.c > @@ -172,6 +174,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/conf/conf_ssl.c > $(OPENSSL_PATH)/crypto/cpt_err.c > $(OPENSSL_PATH)/crypto/cryptlib.c > + $(OPENSSL_PATH)/crypto/ctype.c > $(OPENSSL_PATH)/crypto/cversion.c > $(OPENSSL_PATH)/crypto/des/cbc_cksm.c > $(OPENSSL_PATH)/crypto/des/cbc_enc.c > @@ -189,7 +192,6 @@ [Sources] > $(OPENSSL_PATH)/crypto/des/pcbc_enc.c > $(OPENSSL_PATH)/crypto/des/qud_cksm.c > $(OPENSSL_PATH)/crypto/des/rand_key.c > - $(OPENSSL_PATH)/crypto/des/rpc_enc.c > $(OPENSSL_PATH)/crypto/des/set_key.c > $(OPENSSL_PATH)/crypto/des/str2key.c > $(OPENSSL_PATH)/crypto/des/xcbc_enc.c > @@ -206,6 +208,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/dh/dh_pmeth.c > $(OPENSSL_PATH)/crypto/dh/dh_prn.c > $(OPENSSL_PATH)/crypto/dh/dh_rfc5114.c > + $(OPENSSL_PATH)/crypto/dh/dh_rfc7919.c > $(OPENSSL_PATH)/crypto/dso/dso_dl.c > $(OPENSSL_PATH)/crypto/dso/dso_dlfcn.c > $(OPENSSL_PATH)/crypto/dso/dso_err.c > @@ -228,6 +231,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/evp/e_aes.c > $(OPENSSL_PATH)/crypto/evp/e_aes_cbc_hmac_sha1.c > $(OPENSSL_PATH)/crypto/evp/e_aes_cbc_hmac_sha256.c > + $(OPENSSL_PATH)/crypto/evp/e_aria.c > $(OPENSSL_PATH)/crypto/evp/e_bf.c > $(OPENSSL_PATH)/crypto/evp/e_camellia.c > $(OPENSSL_PATH)/crypto/evp/e_cast.c > @@ -242,6 +246,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/evp/e_rc4_hmac_md5.c > $(OPENSSL_PATH)/crypto/evp/e_rc5.c > $(OPENSSL_PATH)/crypto/evp/e_seed.c > + $(OPENSSL_PATH)/crypto/evp/e_sm4.c > $(OPENSSL_PATH)/crypto/evp/e_xcbc_d.c > $(OPENSSL_PATH)/crypto/evp/encode.c > $(OPENSSL_PATH)/crypto/evp/evp_cnf.c > @@ -259,6 +264,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/evp/m_null.c > $(OPENSSL_PATH)/crypto/evp/m_ripemd.c > $(OPENSSL_PATH)/crypto/evp/m_sha1.c > + $(OPENSSL_PATH)/crypto/evp/m_sha3.c > $(OPENSSL_PATH)/crypto/evp/m_sigver.c > $(OPENSSL_PATH)/crypto/evp/m_wp.c > $(OPENSSL_PATH)/crypto/evp/names.c > @@ -271,10 +277,10 @@ [Sources] > $(OPENSSL_PATH)/crypto/evp/p_seal.c > $(OPENSSL_PATH)/crypto/evp/p_sign.c > $(OPENSSL_PATH)/crypto/evp/p_verify.c > + $(OPENSSL_PATH)/crypto/evp/pbe_scrypt.c > $(OPENSSL_PATH)/crypto/evp/pmeth_fn.c > $(OPENSSL_PATH)/crypto/evp/pmeth_gn.c > $(OPENSSL_PATH)/crypto/evp/pmeth_lib.c > - $(OPENSSL_PATH)/crypto/evp/scrypt.c > $(OPENSSL_PATH)/crypto/ex_data.c > $(OPENSSL_PATH)/crypto/getenv.c > $(OPENSSL_PATH)/crypto/hmac/hm_ameth.c > @@ -283,6 +289,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/init.c > $(OPENSSL_PATH)/crypto/kdf/hkdf.c > $(OPENSSL_PATH)/crypto/kdf/kdf_err.c > + $(OPENSSL_PATH)/crypto/kdf/scrypt.c > $(OPENSSL_PATH)/crypto/kdf/tls1_prf.c > $(OPENSSL_PATH)/crypto/lhash/lh_stats.c > $(OPENSSL_PATH)/crypto/lhash/lhash.c > @@ -360,14 +367,14 @@ [Sources] > $(OPENSSL_PATH)/crypto/pkcs7/pk7_mime.c > $(OPENSSL_PATH)/crypto/pkcs7/pk7_smime.c > $(OPENSSL_PATH)/crypto/pkcs7/pkcs7err.c > - $(OPENSSL_PATH)/crypto/rand/md_rand.c > + $(OPENSSL_PATH)/crypto/rand/drbg_ctr.c > + $(OPENSSL_PATH)/crypto/rand/drbg_lib.c > $(OPENSSL_PATH)/crypto/rand/rand_egd.c > $(OPENSSL_PATH)/crypto/rand/rand_err.c > $(OPENSSL_PATH)/crypto/rand/rand_lib.c > $(OPENSSL_PATH)/crypto/rand/rand_unix.c > $(OPENSSL_PATH)/crypto/rand/rand_vms.c > $(OPENSSL_PATH)/crypto/rand/rand_win.c > - $(OPENSSL_PATH)/crypto/rand/randfile.c > $(OPENSSL_PATH)/crypto/rc4/rc4_enc.c > $(OPENSSL_PATH)/crypto/rc4/rc4_skey.c > $(OPENSSL_PATH)/crypto/rsa/rsa_ameth.c > @@ -379,8 +386,8 @@ [Sources] > $(OPENSSL_PATH)/crypto/rsa/rsa_gen.c > $(OPENSSL_PATH)/crypto/rsa/rsa_lib.c > $(OPENSSL_PATH)/crypto/rsa/rsa_meth.c > + $(OPENSSL_PATH)/crypto/rsa/rsa_mp.c > $(OPENSSL_PATH)/crypto/rsa/rsa_none.c > - $(OPENSSL_PATH)/crypto/rsa/rsa_null.c > $(OPENSSL_PATH)/crypto/rsa/rsa_oaep.c > $(OPENSSL_PATH)/crypto/rsa/rsa_ossl.c > $(OPENSSL_PATH)/crypto/rsa/rsa_pk1.c > @@ -392,15 +399,27 @@ [Sources] > $(OPENSSL_PATH)/crypto/rsa/rsa_ssl.c > $(OPENSSL_PATH)/crypto/rsa/rsa_x931.c > $(OPENSSL_PATH)/crypto/rsa/rsa_x931g.c > + $(OPENSSL_PATH)/crypto/sha/keccak1600.c > $(OPENSSL_PATH)/crypto/sha/sha1_one.c > $(OPENSSL_PATH)/crypto/sha/sha1dgst.c > $(OPENSSL_PATH)/crypto/sha/sha256.c > $(OPENSSL_PATH)/crypto/sha/sha512.c > + $(OPENSSL_PATH)/crypto/siphash/siphash.c > + $(OPENSSL_PATH)/crypto/siphash/siphash_ameth.c > + $(OPENSSL_PATH)/crypto/siphash/siphash_pmeth.c > + $(OPENSSL_PATH)/crypto/sm3/m_sm3.c > + $(OPENSSL_PATH)/crypto/sm3/sm3.c > + $(OPENSSL_PATH)/crypto/sm4/sm4.c > $(OPENSSL_PATH)/crypto/stack/stack.c > $(OPENSSL_PATH)/crypto/threads_none.c > $(OPENSSL_PATH)/crypto/threads_pthread.c > $(OPENSSL_PATH)/crypto/threads_win.c > $(OPENSSL_PATH)/crypto/txt_db/txt_db.c > + $(OPENSSL_PATH)/crypto/ui/ui_err.c > + $(OPENSSL_PATH)/crypto/ui/ui_lib.c > + $(OPENSSL_PATH)/crypto/ui/ui_null.c > + $(OPENSSL_PATH)/crypto/ui/ui_openssl.c > + $(OPENSSL_PATH)/crypto/ui/ui_util.c > $(OPENSSL_PATH)/crypto/uid.c > $(OPENSSL_PATH)/crypto/x509/by_dir.c > $(OPENSSL_PATH)/crypto/x509/by_file.c > @@ -445,6 +464,7 @@ [Sources] > $(OPENSSL_PATH)/crypto/x509v3/pcy_node.c > $(OPENSSL_PATH)/crypto/x509v3/pcy_tree.c > $(OPENSSL_PATH)/crypto/x509v3/v3_addr.c > + $(OPENSSL_PATH)/crypto/x509v3/v3_admis.c > $(OPENSSL_PATH)/crypto/x509v3/v3_akey.c > $(OPENSSL_PATH)/crypto/x509v3/v3_akeya.c > $(OPENSSL_PATH)/crypto/x509v3/v3_alt.c > @@ -476,12 +496,29 @@ [Sources] > $(OPENSSL_PATH)/crypto/x509v3/v3err.c > # Autogenerated files list ends here > > + ossl_store.c > + rand_pool.c > + > +[Sources.Ia32] > + rand_pool_noise_tsc.c > + > +[Sources.X64] > + rand_pool_noise_tsc.c > + > +[Sources.ARM] > + rand_pool_noise.c > + > +[Sources.AARCH64] > + rand_pool_noise.c > + > [Packages] > MdePkg/MdePkg.dec > CryptoPkg/CryptoPkg.dec > > [LibraryClasses] > + BaseLib > DebugLib > + TimerLib > > [LibraryClasses.ARM] > ArmSoftFloatLib > diff --git a/CryptoPkg/Library/Include/CrtLibSupport.h > b/CryptoPkg/Library/Include/CrtLibSupport.h > index b05c5d908ce2..5806f50f7485 100644 > --- a/CryptoPkg/Library/Include/CrtLibSupport.h > +++ b/CryptoPkg/Library/Include/CrtLibSupport.h > @@ -2,7 +2,7 @@ > Root include file of C runtime library to support building the third-party > cryptographic library. > > -Copyright (c) 2010 - 2017, Intel Corporation. All rights > reserved.<BR> > +Copyright (c) 2010 - 2019, Intel Corporation. All rights > +reserved.<BR> > SPDX-License-Identifier: BSD-2-Clause-Patent > > **/ > @@ -21,6 +21,17 @@ SPDX-License-Identifier: BSD-2-Clause-Patent > #define MAX_STRING_SIZE 0x1000 > > // > +// We already have "no-ui" in out Configure invocation. > +// but the code still fails to compile. > +// Ref: https://github.com/openssl/openssl/issues/8904 > +// > +// This is defined in CRT library(stdio.h). > +// > +#ifndef BUFSIZ > +#define BUFSIZ 8192 > +#endif > + > +// > // OpenSSL relies on explicit configuration for word size in > crypto/bn, // but we want it to be automatically inferred from the > target. So we // bypass what's in <openssl/opensslconf.h> for > OPENSSL_SYS_UEFI, and diff --git > a/CryptoPkg/Library/Include/openssl/opensslconf.h > b/CryptoPkg/Library/Include/openssl/opensslconf.h > index 28dd9ab93c61..07fa2d3ce280 100644 > --- a/CryptoPkg/Library/Include/openssl/opensslconf.h > +++ b/CryptoPkg/Library/Include/openssl/opensslconf.h > @@ -10,6 +10,8 @@ > * https://www.openssl.org/source/license.html > */ > > +#include <openssl/opensslv.h> > + > #ifdef __cplusplus > extern "C" { > #endif > @@ -77,18 +79,21 @@ extern "C" { > #ifndef OPENSSL_NO_SEED > # define OPENSSL_NO_SEED > #endif > +#ifndef OPENSSL_NO_SM2 > +# define OPENSSL_NO_SM2 > +#endif > #ifndef OPENSSL_NO_SRP > # define OPENSSL_NO_SRP > #endif > #ifndef OPENSSL_NO_TS > # define OPENSSL_NO_TS > #endif > -#ifndef OPENSSL_NO_UI > -# define OPENSSL_NO_UI > -#endif > #ifndef OPENSSL_NO_WHIRLPOOL > # define OPENSSL_NO_WHIRLPOOL > #endif > +#ifndef OPENSSL_RAND_SEED_NONE > +# define OPENSSL_RAND_SEED_NONE > +#endif > #ifndef OPENSSL_NO_AFALGENG > # define OPENSSL_NO_AFALGENG > #endif > @@ -122,6 +127,9 @@ extern "C" { > #ifndef OPENSSL_NO_DEPRECATED > # define OPENSSL_NO_DEPRECATED > #endif > +#ifndef OPENSSL_NO_DEVCRYPTOENG > +# define OPENSSL_NO_DEVCRYPTOENG > +#endif > #ifndef OPENSSL_NO_DGRAM > # define OPENSSL_NO_DGRAM > #endif > @@ -155,6 +163,9 @@ extern "C" { > #ifndef OPENSSL_NO_ERR > # define OPENSSL_NO_ERR > #endif > +#ifndef OPENSSL_NO_EXTERNAL_TESTS > +# define OPENSSL_NO_EXTERNAL_TESTS > +#endif > #ifndef OPENSSL_NO_FILENAMES > # define OPENSSL_NO_FILENAMES > #endif > @@ -209,15 +220,24 @@ extern "C" { > #ifndef OPENSSL_NO_TESTS > # define OPENSSL_NO_TESTS > #endif > +#ifndef OPENSSL_NO_TLS1_3 > +# define OPENSSL_NO_TLS1_3 > +#endif > #ifndef OPENSSL_NO_UBSAN > # define OPENSSL_NO_UBSAN > #endif > +#ifndef OPENSSL_NO_UI_CONSOLE > +# define OPENSSL_NO_UI_CONSOLE > +#endif > #ifndef OPENSSL_NO_UNIT_TEST > # define OPENSSL_NO_UNIT_TEST > #endif > #ifndef OPENSSL_NO_WEAK_SSL_CIPHERS > # define OPENSSL_NO_WEAK_SSL_CIPHERS > #endif > +#ifndef OPENSSL_NO_DYNAMIC_ENGINE > +# define OPENSSL_NO_DYNAMIC_ENGINE > +#endif > #ifndef OPENSSL_NO_AFALGENG > # define OPENSSL_NO_AFALGENG > #endif > @@ -236,15 +256,11 @@ extern "C" { > * functions. > */ > #ifndef DECLARE_DEPRECATED > -# if defined(OPENSSL_NO_DEPRECATED) > -# define DECLARE_DEPRECATED(f) > -# else > -# define DECLARE_DEPRECATED(f) f; > -# ifdef __GNUC__ > -# if __GNUC__ > 3 || (__GNUC__ == 3 && __GNUC_MINOR__ > 0) > -# undef DECLARE_DEPRECATED > -# define DECLARE_DEPRECATED(f) f __attribute__ ((deprecated)); > -# endif > +# define DECLARE_DEPRECATED(f) f; > +# ifdef __GNUC__ > +# if __GNUC__ > 3 || (__GNUC__ == 3 && __GNUC_MINOR__ > 0) > +# undef DECLARE_DEPRECATED > +# define DECLARE_DEPRECATED(f) f __attribute__ ((deprecated)); > # endif > # endif > #endif > @@ -268,6 +284,18 @@ extern "C" { > # define OPENSSL_API_COMPAT OPENSSL_MIN_API #endif > > +/* > + * Do not deprecate things to be deprecated in version 1.2.0 before > +the > + * OpenSSL version number matches. > + */ > +#if OPENSSL_VERSION_NUMBER < 0x10200000L > +# define DEPRECATEDIN_1_2_0(f) f; > +#elif OPENSSL_API_COMPAT < 0x10200000L > +# define DEPRECATEDIN_1_2_0(f) DECLARE_DEPRECATED(f) > +#else > +# define DEPRECATEDIN_1_2_0(f) > +#endif > + > #if OPENSSL_API_COMPAT < 0x10100000L > # define DEPRECATEDIN_1_1_0(f) DECLARE_DEPRECATED(f) > #else > @@ -286,8 +314,6 @@ extern "C" { > # define DEPRECATEDIN_0_9_8(f) > #endif > > - > - > /* Generate 80386 code? */ > #undef I386_ONLY > > diff --git a/CryptoPkg/Library/OpensslLib/buildinf.h > b/CryptoPkg/Library/OpensslLib/buildinf.h > index c5ca293c729f..b840c8656a28 100644 > --- a/CryptoPkg/Library/OpensslLib/buildinf.h > +++ b/CryptoPkg/Library/OpensslLib/buildinf.h > @@ -1,2 +1,4 @@ > #define PLATFORM "UEFI" > #define DATE "Fri Dec 22 01:23:45 PDT 2017" > + > +const char * compiler_flags = "compiler: information not available > +from edk2"; > diff --git a/CryptoPkg/Library/OpensslLib/rand_pool_noise.h > b/CryptoPkg/Library/OpensslLib/rand_pool_noise.h > new file mode 100644 > index 000000000000..75acc686a9f1 > --- /dev/null > +++ b/CryptoPkg/Library/OpensslLib/rand_pool_noise.h > @@ -0,0 +1,29 @@ > +/** @file > + Provide rand noise source. > + > +Copyright (c) 2019, Intel Corporation. All rights reserved.<BR> > +SPDX-License-Identifier: BSD-2-Clause-Patent > + > +**/ > + > +#ifndef __RAND_POOL_NOISE_H__ > +#define __RAND_POOL_NOISE_H__ > + > +#include <Uefi/UefiBaseType.h> > + > +/** > + Get 64-bit noise source. > + > + @param[out] Rand Buffer pointer to store 64-bit noise source > + > + @retval TRUE Get randomness successfully. > + @retval FALSE Failed to generate > +**/ > +BOOLEAN > +EFIAPI > +GetRandomNoise64 ( > + OUT UINT64 *Rand > + ); > + > + > +#endif // __RAND_POOL_NOISE_H__ > diff --git a/CryptoPkg/Library/OpensslLib/ossl_store.c > b/CryptoPkg/Library/OpensslLib/ossl_store.c > new file mode 100644 > index 000000000000..29e1506048e3 > --- /dev/null > +++ b/CryptoPkg/Library/OpensslLib/ossl_store.c > @@ -0,0 +1,17 @@ > +/** @file > + Dummy implement ossl_store(Store retrieval functions) for UEFI. > + > +Copyright (c) 2019, Intel Corporation. All rights reserved.<BR> > +SPDX-License-Identifier: BSD-2-Clause-Patent > + > +**/ > + > +/* > + * This function is cleanup ossl store. > + * > + * Dummy Implement for UEFI > + */ > +void ossl_store_cleanup_int(void) > +{ > +} > + > diff --git a/CryptoPkg/Library/OpensslLib/rand_pool.c > b/CryptoPkg/Library/OpensslLib/rand_pool.c > new file mode 100644 > index 000000000000..9d2a4ad13823 > --- /dev/null > +++ b/CryptoPkg/Library/OpensslLib/rand_pool.c > @@ -0,0 +1,316 @@ > +/** @file > + OpenSSL_1_1_1b doesn't implement rand_pool_* functions for UEFI. > + The file implement these functions. > + > +Copyright (c) 2019, Intel Corporation. All rights reserved.<BR> > +SPDX-License-Identifier: BSD-2-Clause-Patent > + > +**/ > + > +#include "internal/rand_int.h" > +#include <openssl/aes.h> > + > +#include <Uefi.h> > +#include <Library/TimerLib.h> > + > +#include "rand_pool_noise.h" > + > +/** > + Get some randomness from low-order bits of GetPerformanceCounter results. > + And combine them to the 64-bit value > + > + @param[out] Rand Buffer pointer to store the 64-bit random value. > + > + @retval TRUE Random number generated successfully. > + @retval FALSE Failed to generate. > +**/ > +STATIC > +BOOLEAN > +EFIAPI > +GetRandNoise64FromPerformanceCounter( > + OUT UINT64 *Rand > + ) > +{ > + UINT32 Index; > + UINT32 *RandPtr; > + > + if (NULL == Rand) { > + return FALSE; > + } > + > + RandPtr = (UINT32 *) Rand; > + > + for (Index = 0; Index < 2; Index ++) { > + *RandPtr = (UINT32) (GetPerformanceCounter () & 0xFF); > + MicroSecondDelay (10); > + RandPtr++; > + } > + > + return TRUE; > +} > + > +/** > + Calls RandomNumber64 to fill > + a buffer of arbitrary size with random bytes. > + > + @param[in] Length Size of the buffer, in bytes, to fill with. > + @param[out] RandBuffer Pointer to the buffer to store the random result. > + > + @retval EFI_SUCCESS Random bytes generation succeeded. > + @retval EFI_NOT_READY Failed to request random bytes. > + > +**/ > +STATIC > +BOOLEAN > +EFIAPI > +RandGetBytes ( > + IN UINTN Length, > + OUT UINT8 *RandBuffer > + ) > +{ > + BOOLEAN Ret; > + UINT64 TempRand; > + > + Ret = FALSE; > + > + while (Length > 0) { > + // > + // Get random noise from platform. > + // If it failed, fallback to PerformanceCounter > + // If you really care about security, you must override > + // GetRandomNoise64FromPlatform. > + // > + Ret = GetRandomNoise64 (&TempRand); > + if (Ret == FALSE) { > + Ret = GetRandNoise64FromPerformanceCounter (&TempRand); > + } > + if (!Ret) { > + return Ret; > + } > + if (Length >= sizeof (TempRand)) { > + *((UINT64*) RandBuffer) = TempRand; > + RandBuffer += sizeof (UINT64); > + Length -= sizeof (TempRand); > + } else { > + CopyMem (RandBuffer, &TempRand, Length); > + Length = 0; > + } > + } > + > + return Ret; > +} > + > +/** > + Creates a 128bit random value that is fully forward and backward > +prediction resistant, > + suitable for seeding a NIST SP800-90 Compliant. > + This function takes multiple random numbers from PerformanceCounter > +to ensure reseeding > + and performs AES-CBC-MAC over the data to compute the seed value. > + > + @param[out] SeedBuffer Pointer to a 128bit buffer to store the random seed. > + > + @retval TRUE Random seed generation succeeded. > + @retval FALSE Failed to request random bytes. > + > +**/ > +STATIC > +BOOLEAN > +EFIAPI > +RandGetSeed128 ( > + OUT UINT8 *SeedBuffer > + ) > +{ > + BOOLEAN Ret; > + UINT8 RandByte[16]; > + UINT8 Key[16]; > + UINT8 Ffv[16]; > + UINT8 Xored[16]; > + UINT32 Index; > + UINT32 Index2; > + AES_KEY AESKey; > + > + // > + // Chose an arbitary key and zero the feed_forward_value (FFV) // > + for (Index = 0; Index < 16; Index++) { > + Key[Index] = (UINT8) Index; > + Ffv[Index] = 0; > + } > + > + AES_set_encrypt_key (Key, 16 * 8, &AESKey); > + > + // > + // Perform CBC_MAC over 32 * 128 bit values, with 10us gaps between > + 128 bit value // The 10us gaps will ensure multiple reseeds within > + the system time with a large // design margin. > + // > + for (Index = 0; Index < 32; Index++) { > + MicroSecondDelay (10); > + Ret = RandGetBytes (16, RandByte); > + if (!Ret) { > + return Ret; > + } > + > + // > + // Perform XOR operations on two 128-bit value. > + // > + for (Index2 = 0; Index2 < 16; Index2++) { > + Xored[Index2] = RandByte[Index2] ^ Ffv[Index2]; > + } > + > + AES_encrypt (Xored, Ffv, &AESKey); } > + > + for (Index = 0; Index < 16; Index++) { > + SeedBuffer[Index] = Ffv[Index]; > + } > + > + return Ret; > +} > + > +/** > + Generate high-quality entropy source. > + > + @param[in] Length Size of the buffer, in bytes, to fill with. > + @param[out] Entropy Pointer to the buffer to store the entropy data. > + > + @retval EFI_SUCCESS Entropy generation succeeded. > + @retval EFI_NOT_READY Failed to request random data. > + > +**/ > +STATIC > +BOOLEAN > +EFIAPI > +RandGenerateEntropy ( > + IN UINTN Length, > + OUT UINT8 *Entropy > + ) > +{ > + BOOLEAN Ret; > + UINTN BlockCount; > + UINT8 Seed[16]; > + UINT8 *Ptr; > + > + BlockCount = Length / 16; > + Ptr = (UINT8 *) Entropy; > + > + // > + // Generate high-quality seed for DRBG Entropy // while > + (BlockCount > 0) { > + Ret = RandGetSeed128 (Seed); > + if (!Ret) { > + return Ret; > + } > + CopyMem (Ptr, Seed, 16); > + > + BlockCount--; > + Ptr = Ptr + 16; > + } > + > + // > + // Populate the remained data as request. > + // > + Ret = RandGetSeed128 (Seed); > + if (!Ret) { > + return Ret; > + } > + CopyMem (Ptr, Seed, (Length % 16)); > + > + return Ret; > +} > + > +/* > + * Add random bytes to the pool to acquire requested amount of > +entropy > + * > + * This function is platform specific and tries to acquire the > +requested > + * amount of entropy by polling platform specific entropy sources. > + * > + * This is OpenSSL required interface. > + */ > +size_t rand_pool_acquire_entropy(RAND_POOL *pool) { > + BOOLEAN Ret; > + size_t bytes_needed; > + unsigned char * buffer; > + > + bytes_needed = rand_pool_bytes_needed(pool, 1 /*entropy_factor*/); > + if (bytes_needed > 0) { > + buffer = rand_pool_add_begin(pool, bytes_needed); > + > + if (buffer != NULL) { > + Ret = RandGenerateEntropy(bytes_needed, buffer); > + if (FALSE == Ret) { > + rand_pool_add_end(pool, 0, 0); > + } else { > + rand_pool_add_end(pool, bytes_needed, 8 * bytes_needed); > + } > + } > + } > + > + return rand_pool_entropy_available(pool); > +} > + > +/* > + * Implementation for UEFI > + * > + * This is OpenSSL required interface. > + */ > +int rand_pool_add_nonce_data(RAND_POOL *pool) { > + struct { > + UINT64 Rand; > + UINT64 TimerValue; > + } data = { 0 }; > + > + RandGetBytes(8, (UINT8 *)&(data.Rand)); data.TimerValue = > + GetPerformanceCounter(); > + > + return rand_pool_add(pool, (unsigned char*)&data, sizeof(data), 0); > +} > + > +/* > + * Implementation for UEFI > + * > + * This is OpenSSL required interface. > + */ > +int rand_pool_add_additional_data(RAND_POOL *pool) { > + struct { > + UINT64 Rand; > + UINT64 TimerValue; > + } data = { 0 }; > + > + RandGetBytes(8, (UINT8 *)&(data.Rand)); data.TimerValue = > + GetPerformanceCounter(); > + > + return rand_pool_add(pool, (unsigned char*)&data, sizeof(data), 0); > +} > + > +/* > + * Dummy Implememtation for UEFI > + * > + * This is OpenSSL required interface. > + */ > +int rand_pool_init(void) > +{ > + return 1; > +} > + > +/* > + * Dummy Implememtation for UEFI > + * > + * This is OpenSSL required interface. > + */ > +void rand_pool_cleanup(void) > +{ > +} > + > +/* > + * Dummy Implememtation for UEFI > + * > + * This is OpenSSL required interface. > + */ > +void rand_pool_keep_random_devices_open(int keep) { } > + > diff --git a/CryptoPkg/Library/OpensslLib/rand_pool_noise.c > b/CryptoPkg/Library/OpensslLib/rand_pool_noise.c > new file mode 100644 > index 000000000000..c16ed8b45496 > --- /dev/null > +++ b/CryptoPkg/Library/OpensslLib/rand_pool_noise.c > @@ -0,0 +1,29 @@ > +/** @file > + Provide rand noise source. > + > +Copyright (c) 2019, Intel Corporation. All rights reserved.<BR> > +SPDX-License-Identifier: BSD-2-Clause-Patent > + > +**/ > + > +#include <Library/BaseLib.h> > + > +/** > + Get 64-bit noise source > + > + @param[out] Rand Buffer pointer to store 64-bit noise source > + > + @retval FALSE Failed to generate > +**/ > +BOOLEAN > +EFIAPI > +GetRandomNoise64 ( > + OUT UINT64 *Rand > + ) > +{ > + // > + // Return FALSE will fallback to use PerformaceCounter to > + // generate noise. > + // > + return FALSE; > +} > diff --git a/CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c > b/CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c > new file mode 100644 > index 000000000000..4158106231fd > --- /dev/null > +++ b/CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c > @@ -0,0 +1,43 @@ > +/** @file > + Provide rand noise source. > + > +Copyright (c) 2019, Intel Corporation. All rights reserved.<BR> > +SPDX-License-Identifier: BSD-2-Clause-Patent > + > +**/ > + > +#include <Library/BaseLib.h> > +#include <Library/DebugLib.h> > +#include <Library/TimerLib.h> > + > +/** > + Get 64-bit noise source > + > + @param[out] Rand Buffer pointer to store 64-bit noise source > + > + @retval TRUE Get randomness successfully. > + @retval FALSE Failed to generate > +**/ > +BOOLEAN > +EFIAPI > +GetRandomNoise64 ( > + OUT UINT64 *Rand > + ) > +{ > + UINT32 Index; > + UINT32 *RandPtr; > + > + if (NULL == Rand) { > + return FALSE; > + } > + > + RandPtr = (UINT32 *)Rand; > + > + for (Index = 0; Index < 2; Index ++) { > + *RandPtr = (UINT32) ((AsmReadTsc ()) & 0xFF); > + RandPtr++; > + MicroSecondDelay (10); > + } > + > + return TRUE; > +} > diff --git a/CryptoPkg/Library/OpensslLib/openssl > b/CryptoPkg/Library/OpensslLib/openssl > index 74f2d9c1ec5f..50eaac9f3337 160000 > --- a/CryptoPkg/Library/OpensslLib/openssl > +++ b/CryptoPkg/Library/OpensslLib/openssl > @@ -1 +1 @@ > -Subproject commit 74f2d9c1ec5f5510e1d3da5a9f03c28df0977762 > +Subproject commit 50eaac9f3337667259de725451f201e784599687 > ^ permalink raw reply [flat|nested] 39+ messages in thread
* Re: [edk2-devel] [PATCH v4 6/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b 2019-05-17 11:14 ` Xiaoyu Lu @ 2019-05-17 13:15 ` Laszlo Ersek 2019-05-18 7:16 ` Xiaoyu Lu 0 siblings, 1 reply; 39+ messages in thread From: Laszlo Ersek @ 2019-05-17 13:15 UTC (permalink / raw) To: Lu, XiaoyuX, devel@edk2.groups.io, Wang, Jian J; +Cc: Ye, Ting On 05/17/19 13:14, Lu, XiaoyuX wrote: > Laszlo, > > I think (b) is better and have already done this. What do you mean by "already done"? In your personal development tree perhaps? > About (b/1): > > One the one hand, the implementation still need discuss later. > On the other hand: > > Refer to openssl/INSTALL the meaning of --with-rand-seed=none > > > none: Disable automatic seeding. This is the default > > on some operating systems where no suitable > > entropy source exists, or no support for it is > > implemented yet. > > I think when --with-rand-seed=none option is set, the best way to implement rand_pool_acquire_entropy should like this: > >> size_t rand_pool_acquire_entropy(RAND_POOL *pool) >> { >> return rand_pool_entropy_available(pool); >> } >> >> int rand_pool_add_nonce_data(RAND_POOL *pool) >> { >> // I think PerformanceCounter is an optional nonce. >> UINT64 data; >> data = GetPerformanceCounter(); >> >> return rand_pool_add(pool, (unsigned char*)&data, sizeof(data), 0);>} >> >> int rand_pool_add_additional_data(RAND_POOL *pool) >> { >> return 0; >> } > > With this, we handed the Rand_seed work to caller. (caller must provide safe seed). > > What do you think? Sorry, no idea. Thanks Laszlo > > Thanks, > Xiaoyu > > -----Original Message----- > From: Laszlo Ersek [mailto:lersek@redhat.com] > Sent: Friday, May 17, 2019 12:32 AM > To: devel@edk2.groups.io; Lu, XiaoyuX <xiaoyux.lu@intel.com>; Wang, Jian J <jian.j.wang@intel.com> > Cc: Ye, Ting <ting.ye@intel.com> > Subject: Re: [edk2-devel] [PATCH v4 6/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b > > Hi Jian, > > On 05/16/19 09:54, Xiaoyu lu wrote: >> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1089 >> >> * Update OpenSSL submodule to OpenSSL_1_1_1b >> OpenSSL_1_1_1b(50eaac9f3337667259de725451f201e784599687) >> >> * Run process_files.pl script to regenerate OpensslLib[Crypto].inf >> and opensslconf.h >> >> * Remove -DNO_SYSLOG from OPENSSL_FLAGS in OpensslLib[Crypto].inf, >> due to upstream OpenSSL commit cff55b90e95e("Cleaning UEFI >> Build with additional OPENSSL_SYS_UEFI flags", 2017-03-29), >> which was first released as part of OpenSSL_1_1_1. >> >> * Starting with OpenSSL commit 8a8d9e1905(first release in >> OpenSSL_1_1_1), the OpenSSL_version() function can no longer >> return a pointer to the string literal "compiler: information >> not available", in the case CFLAGS macro is not defined. >> Instead, the function now has a hard dependency on the global >> variable 'compiler_flags'. This variable is normally placed >> by "util/mkbuildinf.pl" into "buildinf.h". In edk2 we don't >> run that script whenever we build OpenSSL, therefore we >> must provide our own dummy 'compiler_flags'. >> >> * From OpenSSL_1_1_0i(97c0959f27b294fe1eb10b547145ebef2524b896) to >> OpenSSL_1_1_1b(50eaac9f3337667259de725451f201e784599687), OpenSSL >> updated DRBG / RAND to request nonce and additional low entropy >> randomness from system(line 229 openssl/CHANGES). >> >> Since OpenSSL_1_1_1b doesn't fully implement rand pool functions >> for UEFI. We must provide a method to implenet these method. >> TSC is used as first entropy source if it's availabe otherwise >> fallback to TimerLib. But we are not sure the amount of randomness >> they provide. If you really care about the security, one choice is >> overrided it with hardware generator. >> >> Add rand_pool.c to implement these functions required by OpenSSL >> rand_pool_acquire_entropy >> rand_pool_add_nonce_data >> rand_pool_add_additional_data >> rand_pool_init >> rand_pool_cleanup >> rand_pool_keep_random_devices_open >> >> And add rand_pool_noise.* for getting entropy noise from different >> architecture. >> >> * We don't need ossl_store functions. We exclude relative files >> through process_files.pl. And ossl_store_cleanup_int was first >> added in crypto/init.c OpenSSL_1_1_1(71a5516d). >> So add a new file(ossl_store.c) to implement ossl_store_cleanup_int >> function. >> >> * BUFSIZ is used by crypto/evp/evp_key.c(OpenSSL_1_1_1b) >> And it is declared in stdio.h. So add it to CrtLibSupport.h. >> Here's a discussion about this. >> Ref: https://github.com/openssl/openssl/issues/8904 >> >> Cc: Jian J Wang <jian.j.wang@intel.com> >> Cc: Ting Ye <ting.ye@intel.com> >> Signed-off-by: Xiaoyu Lu <xiaoyux.lu@intel.com> >> --- >> CryptoPkg/Library/OpensslLib/OpensslLib.inf | 60 +++- >> CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 51 +++- >> CryptoPkg/Library/Include/CrtLibSupport.h | 13 +- >> CryptoPkg/Library/Include/openssl/opensslconf.h | 54 +++- >> CryptoPkg/Library/OpensslLib/buildinf.h | 2 + >> CryptoPkg/Library/OpensslLib/rand_pool_noise.h | 29 ++ >> CryptoPkg/Library/OpensslLib/ossl_store.c | 17 ++ >> CryptoPkg/Library/OpensslLib/rand_pool.c | 316 +++++++++++++++++++++ >> CryptoPkg/Library/OpensslLib/rand_pool_noise.c | 29 ++ >> CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c | 43 +++ >> CryptoPkg/Library/OpensslLib/openssl | 2 +- >> 11 files changed, 584 insertions(+), 32 deletions(-) create mode >> 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.h >> create mode 100644 CryptoPkg/Library/OpensslLib/ossl_store.c >> create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool.c >> create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.c >> create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c > > For this patch, I can offer two kinds of reviews: > > ---*--- > > (a) If you prefer to push this patch in the present form (that is, exactly as posted), then I will not give any official feedback tags, due to the crypto contents. I will not block the patch either, so if you and Ting are fine with the patch, it's OK for you to push it, from my side. > > ---*--- > > (b) Alternatively, you could split the patch in two halves, as follows: > > (b/1) In the first half, collect all the hunks for the following files: > > CryptoPkg/Library/OpensslLib/ossl_store.c > CryptoPkg/Library/OpensslLib/rand_pool.c > CryptoPkg/Library/OpensslLib/rand_pool_noise.c > CryptoPkg/Library/OpensslLib/rand_pool_noise.h > CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c > > plus include the commit message paragraphs about "rand_pool.c" and "ossl_store.c". > > For this half (b/1), I will not give any feedback. > > > (b/2) In the second half, collect the rest of the changes, that is, the hunks for the following files / submodules, and the rest of the commit > message: > > CryptoPkg/Library/Include/CrtLibSupport.h > CryptoPkg/Library/Include/openssl/opensslconf.h > CryptoPkg/Library/OpensslLib/OpensslLib.inf > CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf > CryptoPkg/Library/OpensslLib/buildinf.h > CryptoPkg/Library/OpensslLib/openssl > > For the (b/2) half *ONLY*, you can add: > > Reviewed-by: Laszlo Ersek <lersek@redhat.com> > > ---*--- > > It's up to you whether you pick (a) or (b). > > Normally I would request a v5 series for implementing (b), but we're out of time. If the community thinks that splitting up this patch into halves (b/1) and (b/2) is too intrusive for a maintainer to do without proper review, then I suggest going with (a) -- and then I'll provide no feedback tags. (But, I will also not block the patch, see above.) > > ... Well, in theory anyway, Xiaoyu could very quickly submit a v5 series, splitting this patch as explained under (b). In that case, the > (b/2) half -- and *ONLY* that half -- of this patch could include my R-b at once. > > So, please decide. > > Thanks! > Laszlo > >> >> diff --git a/CryptoPkg/Library/OpensslLib/OpensslLib.inf >> b/CryptoPkg/Library/OpensslLib/OpensslLib.inf >> index f4d7772c068c..62dd61969cb0 100644 >> --- a/CryptoPkg/Library/OpensslLib/OpensslLib.inf >> +++ b/CryptoPkg/Library/OpensslLib/OpensslLib.inf >> @@ -1,7 +1,7 @@ >> ## @file >> # This module provides OpenSSL Library implementation. >> # >> -# Copyright (c) 2010 - 2018, Intel Corporation. All rights >> reserved.<BR> >> +# Copyright (c) 2010 - 2019, Intel Corporation. All rights >> +reserved.<BR> >> # SPDX-License-Identifier: BSD-2-Clause-Patent # ## @@ -15,7 +15,7 >> @@ [Defines] >> VERSION_STRING = 1.0 >> LIBRARY_CLASS = OpensslLib >> DEFINE OPENSSL_PATH = openssl >> - DEFINE OPENSSL_FLAGS = -DL_ENDIAN -DOPENSSL_SMALL_FOOTPRINT -D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECATE -DNO_SYSLOG >> + DEFINE OPENSSL_FLAGS = -DL_ENDIAN -DOPENSSL_SMALL_FOOTPRINT -D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECATE >> >> # >> # VALID_ARCHITECTURES = IA32 X64 ARM AARCH64 >> @@ -32,6 +32,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/aes/aes_misc.c >> $(OPENSSL_PATH)/crypto/aes/aes_ofb.c >> $(OPENSSL_PATH)/crypto/aes/aes_wrap.c >> + $(OPENSSL_PATH)/crypto/aria/aria.c >> $(OPENSSL_PATH)/crypto/asn1/a_bitstr.c >> $(OPENSSL_PATH)/crypto/asn1/a_d2i_fp.c >> $(OPENSSL_PATH)/crypto/asn1/a_digest.c >> @@ -54,6 +55,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/asn1/ameth_lib.c >> $(OPENSSL_PATH)/crypto/asn1/asn1_err.c >> $(OPENSSL_PATH)/crypto/asn1/asn1_gen.c >> + $(OPENSSL_PATH)/crypto/asn1/asn1_item_list.c >> $(OPENSSL_PATH)/crypto/asn1/asn1_lib.c >> $(OPENSSL_PATH)/crypto/asn1/asn1_par.c >> $(OPENSSL_PATH)/crypto/asn1/asn_mime.c >> @@ -172,6 +174,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/conf/conf_ssl.c >> $(OPENSSL_PATH)/crypto/cpt_err.c >> $(OPENSSL_PATH)/crypto/cryptlib.c >> + $(OPENSSL_PATH)/crypto/ctype.c >> $(OPENSSL_PATH)/crypto/cversion.c >> $(OPENSSL_PATH)/crypto/des/cbc_cksm.c >> $(OPENSSL_PATH)/crypto/des/cbc_enc.c >> @@ -189,7 +192,6 @@ [Sources] >> $(OPENSSL_PATH)/crypto/des/pcbc_enc.c >> $(OPENSSL_PATH)/crypto/des/qud_cksm.c >> $(OPENSSL_PATH)/crypto/des/rand_key.c >> - $(OPENSSL_PATH)/crypto/des/rpc_enc.c >> $(OPENSSL_PATH)/crypto/des/set_key.c >> $(OPENSSL_PATH)/crypto/des/str2key.c >> $(OPENSSL_PATH)/crypto/des/xcbc_enc.c >> @@ -206,6 +208,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/dh/dh_pmeth.c >> $(OPENSSL_PATH)/crypto/dh/dh_prn.c >> $(OPENSSL_PATH)/crypto/dh/dh_rfc5114.c >> + $(OPENSSL_PATH)/crypto/dh/dh_rfc7919.c >> $(OPENSSL_PATH)/crypto/dso/dso_dl.c >> $(OPENSSL_PATH)/crypto/dso/dso_dlfcn.c >> $(OPENSSL_PATH)/crypto/dso/dso_err.c >> @@ -228,6 +231,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/evp/e_aes.c >> $(OPENSSL_PATH)/crypto/evp/e_aes_cbc_hmac_sha1.c >> $(OPENSSL_PATH)/crypto/evp/e_aes_cbc_hmac_sha256.c >> + $(OPENSSL_PATH)/crypto/evp/e_aria.c >> $(OPENSSL_PATH)/crypto/evp/e_bf.c >> $(OPENSSL_PATH)/crypto/evp/e_camellia.c >> $(OPENSSL_PATH)/crypto/evp/e_cast.c >> @@ -242,6 +246,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/evp/e_rc4_hmac_md5.c >> $(OPENSSL_PATH)/crypto/evp/e_rc5.c >> $(OPENSSL_PATH)/crypto/evp/e_seed.c >> + $(OPENSSL_PATH)/crypto/evp/e_sm4.c >> $(OPENSSL_PATH)/crypto/evp/e_xcbc_d.c >> $(OPENSSL_PATH)/crypto/evp/encode.c >> $(OPENSSL_PATH)/crypto/evp/evp_cnf.c >> @@ -259,6 +264,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/evp/m_null.c >> $(OPENSSL_PATH)/crypto/evp/m_ripemd.c >> $(OPENSSL_PATH)/crypto/evp/m_sha1.c >> + $(OPENSSL_PATH)/crypto/evp/m_sha3.c >> $(OPENSSL_PATH)/crypto/evp/m_sigver.c >> $(OPENSSL_PATH)/crypto/evp/m_wp.c >> $(OPENSSL_PATH)/crypto/evp/names.c >> @@ -271,10 +277,10 @@ [Sources] >> $(OPENSSL_PATH)/crypto/evp/p_seal.c >> $(OPENSSL_PATH)/crypto/evp/p_sign.c >> $(OPENSSL_PATH)/crypto/evp/p_verify.c >> + $(OPENSSL_PATH)/crypto/evp/pbe_scrypt.c >> $(OPENSSL_PATH)/crypto/evp/pmeth_fn.c >> $(OPENSSL_PATH)/crypto/evp/pmeth_gn.c >> $(OPENSSL_PATH)/crypto/evp/pmeth_lib.c >> - $(OPENSSL_PATH)/crypto/evp/scrypt.c >> $(OPENSSL_PATH)/crypto/ex_data.c >> $(OPENSSL_PATH)/crypto/getenv.c >> $(OPENSSL_PATH)/crypto/hmac/hm_ameth.c >> @@ -283,6 +289,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/init.c >> $(OPENSSL_PATH)/crypto/kdf/hkdf.c >> $(OPENSSL_PATH)/crypto/kdf/kdf_err.c >> + $(OPENSSL_PATH)/crypto/kdf/scrypt.c >> $(OPENSSL_PATH)/crypto/kdf/tls1_prf.c >> $(OPENSSL_PATH)/crypto/lhash/lh_stats.c >> $(OPENSSL_PATH)/crypto/lhash/lhash.c >> @@ -360,14 +367,14 @@ [Sources] >> $(OPENSSL_PATH)/crypto/pkcs7/pk7_mime.c >> $(OPENSSL_PATH)/crypto/pkcs7/pk7_smime.c >> $(OPENSSL_PATH)/crypto/pkcs7/pkcs7err.c >> - $(OPENSSL_PATH)/crypto/rand/md_rand.c >> + $(OPENSSL_PATH)/crypto/rand/drbg_ctr.c >> + $(OPENSSL_PATH)/crypto/rand/drbg_lib.c >> $(OPENSSL_PATH)/crypto/rand/rand_egd.c >> $(OPENSSL_PATH)/crypto/rand/rand_err.c >> $(OPENSSL_PATH)/crypto/rand/rand_lib.c >> $(OPENSSL_PATH)/crypto/rand/rand_unix.c >> $(OPENSSL_PATH)/crypto/rand/rand_vms.c >> $(OPENSSL_PATH)/crypto/rand/rand_win.c >> - $(OPENSSL_PATH)/crypto/rand/randfile.c >> $(OPENSSL_PATH)/crypto/rc4/rc4_enc.c >> $(OPENSSL_PATH)/crypto/rc4/rc4_skey.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_ameth.c >> @@ -379,8 +386,8 @@ [Sources] >> $(OPENSSL_PATH)/crypto/rsa/rsa_gen.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_lib.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_meth.c >> + $(OPENSSL_PATH)/crypto/rsa/rsa_mp.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_none.c >> - $(OPENSSL_PATH)/crypto/rsa/rsa_null.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_oaep.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_ossl.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_pk1.c >> @@ -392,15 +399,27 @@ [Sources] >> $(OPENSSL_PATH)/crypto/rsa/rsa_ssl.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_x931.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_x931g.c >> + $(OPENSSL_PATH)/crypto/sha/keccak1600.c >> $(OPENSSL_PATH)/crypto/sha/sha1_one.c >> $(OPENSSL_PATH)/crypto/sha/sha1dgst.c >> $(OPENSSL_PATH)/crypto/sha/sha256.c >> $(OPENSSL_PATH)/crypto/sha/sha512.c >> + $(OPENSSL_PATH)/crypto/siphash/siphash.c >> + $(OPENSSL_PATH)/crypto/siphash/siphash_ameth.c >> + $(OPENSSL_PATH)/crypto/siphash/siphash_pmeth.c >> + $(OPENSSL_PATH)/crypto/sm3/m_sm3.c >> + $(OPENSSL_PATH)/crypto/sm3/sm3.c >> + $(OPENSSL_PATH)/crypto/sm4/sm4.c >> $(OPENSSL_PATH)/crypto/stack/stack.c >> $(OPENSSL_PATH)/crypto/threads_none.c >> $(OPENSSL_PATH)/crypto/threads_pthread.c >> $(OPENSSL_PATH)/crypto/threads_win.c >> $(OPENSSL_PATH)/crypto/txt_db/txt_db.c >> + $(OPENSSL_PATH)/crypto/ui/ui_err.c >> + $(OPENSSL_PATH)/crypto/ui/ui_lib.c >> + $(OPENSSL_PATH)/crypto/ui/ui_null.c >> + $(OPENSSL_PATH)/crypto/ui/ui_openssl.c >> + $(OPENSSL_PATH)/crypto/ui/ui_util.c >> $(OPENSSL_PATH)/crypto/uid.c >> $(OPENSSL_PATH)/crypto/x509/by_dir.c >> $(OPENSSL_PATH)/crypto/x509/by_file.c >> @@ -445,6 +464,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/x509v3/pcy_node.c >> $(OPENSSL_PATH)/crypto/x509v3/pcy_tree.c >> $(OPENSSL_PATH)/crypto/x509v3/v3_addr.c >> + $(OPENSSL_PATH)/crypto/x509v3/v3_admis.c >> $(OPENSSL_PATH)/crypto/x509v3/v3_akey.c >> $(OPENSSL_PATH)/crypto/x509v3/v3_akeya.c >> $(OPENSSL_PATH)/crypto/x509v3/v3_alt.c >> @@ -479,12 +499,14 @@ [Sources] >> $(OPENSSL_PATH)/ssl/d1_msg.c >> $(OPENSSL_PATH)/ssl/d1_srtp.c >> $(OPENSSL_PATH)/ssl/methods.c >> + $(OPENSSL_PATH)/ssl/packet.c >> $(OPENSSL_PATH)/ssl/pqueue.c >> $(OPENSSL_PATH)/ssl/record/dtls1_bitmap.c >> $(OPENSSL_PATH)/ssl/record/rec_layer_d1.c >> $(OPENSSL_PATH)/ssl/record/rec_layer_s3.c >> $(OPENSSL_PATH)/ssl/record/ssl3_buffer.c >> $(OPENSSL_PATH)/ssl/record/ssl3_record.c >> + $(OPENSSL_PATH)/ssl/record/ssl3_record_tls13.c >> $(OPENSSL_PATH)/ssl/s3_cbc.c >> $(OPENSSL_PATH)/ssl/s3_enc.c >> $(OPENSSL_PATH)/ssl/s3_lib.c >> @@ -502,25 +524,45 @@ [Sources] >> $(OPENSSL_PATH)/ssl/ssl_stat.c >> $(OPENSSL_PATH)/ssl/ssl_txt.c >> $(OPENSSL_PATH)/ssl/ssl_utst.c >> + $(OPENSSL_PATH)/ssl/statem/extensions.c >> + $(OPENSSL_PATH)/ssl/statem/extensions_clnt.c >> + $(OPENSSL_PATH)/ssl/statem/extensions_cust.c >> + $(OPENSSL_PATH)/ssl/statem/extensions_srvr.c >> $(OPENSSL_PATH)/ssl/statem/statem.c >> $(OPENSSL_PATH)/ssl/statem/statem_clnt.c >> $(OPENSSL_PATH)/ssl/statem/statem_dtls.c >> $(OPENSSL_PATH)/ssl/statem/statem_lib.c >> $(OPENSSL_PATH)/ssl/statem/statem_srvr.c >> $(OPENSSL_PATH)/ssl/t1_enc.c >> - $(OPENSSL_PATH)/ssl/t1_ext.c >> $(OPENSSL_PATH)/ssl/t1_lib.c >> - $(OPENSSL_PATH)/ssl/t1_reneg.c >> $(OPENSSL_PATH)/ssl/t1_trce.c >> + $(OPENSSL_PATH)/ssl/tls13_enc.c >> $(OPENSSL_PATH)/ssl/tls_srp.c >> # Autogenerated files list ends here >> >> + ossl_store.c >> + rand_pool.c >> + >> +[Sources.Ia32] >> + rand_pool_noise_tsc.c >> + >> +[Sources.X64] >> + rand_pool_noise_tsc.c >> + >> +[Sources.ARM] >> + rand_pool_noise.c >> + >> +[Sources.AARCH64] >> + rand_pool_noise.c >> + >> [Packages] >> MdePkg/MdePkg.dec >> CryptoPkg/CryptoPkg.dec >> >> [LibraryClasses] >> + BaseLib >> DebugLib >> + TimerLib >> >> [LibraryClasses.ARM] >> ArmSoftFloatLib >> diff --git a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf >> b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf >> index fd12d112edb2..49599a42d180 100644 >> --- a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf >> +++ b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf >> @@ -1,7 +1,7 @@ >> ## @file >> # This module provides OpenSSL Library implementation. >> # >> -# Copyright (c) 2010 - 2018, Intel Corporation. All rights >> reserved.<BR> >> +# Copyright (c) 2010 - 2019, Intel Corporation. All rights >> +reserved.<BR> >> # SPDX-License-Identifier: BSD-2-Clause-Patent # ## @@ -15,7 +15,7 >> @@ [Defines] >> VERSION_STRING = 1.0 >> LIBRARY_CLASS = OpensslLib >> DEFINE OPENSSL_PATH = openssl >> - DEFINE OPENSSL_FLAGS = -DL_ENDIAN -DOPENSSL_SMALL_FOOTPRINT -D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECATE -DNO_SYSLOG >> + DEFINE OPENSSL_FLAGS = -DL_ENDIAN -DOPENSSL_SMALL_FOOTPRINT -D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECATE >> >> # >> # VALID_ARCHITECTURES = IA32 X64 ARM AARCH64 >> @@ -32,6 +32,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/aes/aes_misc.c >> $(OPENSSL_PATH)/crypto/aes/aes_ofb.c >> $(OPENSSL_PATH)/crypto/aes/aes_wrap.c >> + $(OPENSSL_PATH)/crypto/aria/aria.c >> $(OPENSSL_PATH)/crypto/asn1/a_bitstr.c >> $(OPENSSL_PATH)/crypto/asn1/a_d2i_fp.c >> $(OPENSSL_PATH)/crypto/asn1/a_digest.c >> @@ -54,6 +55,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/asn1/ameth_lib.c >> $(OPENSSL_PATH)/crypto/asn1/asn1_err.c >> $(OPENSSL_PATH)/crypto/asn1/asn1_gen.c >> + $(OPENSSL_PATH)/crypto/asn1/asn1_item_list.c >> $(OPENSSL_PATH)/crypto/asn1/asn1_lib.c >> $(OPENSSL_PATH)/crypto/asn1/asn1_par.c >> $(OPENSSL_PATH)/crypto/asn1/asn_mime.c >> @@ -172,6 +174,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/conf/conf_ssl.c >> $(OPENSSL_PATH)/crypto/cpt_err.c >> $(OPENSSL_PATH)/crypto/cryptlib.c >> + $(OPENSSL_PATH)/crypto/ctype.c >> $(OPENSSL_PATH)/crypto/cversion.c >> $(OPENSSL_PATH)/crypto/des/cbc_cksm.c >> $(OPENSSL_PATH)/crypto/des/cbc_enc.c >> @@ -189,7 +192,6 @@ [Sources] >> $(OPENSSL_PATH)/crypto/des/pcbc_enc.c >> $(OPENSSL_PATH)/crypto/des/qud_cksm.c >> $(OPENSSL_PATH)/crypto/des/rand_key.c >> - $(OPENSSL_PATH)/crypto/des/rpc_enc.c >> $(OPENSSL_PATH)/crypto/des/set_key.c >> $(OPENSSL_PATH)/crypto/des/str2key.c >> $(OPENSSL_PATH)/crypto/des/xcbc_enc.c >> @@ -206,6 +208,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/dh/dh_pmeth.c >> $(OPENSSL_PATH)/crypto/dh/dh_prn.c >> $(OPENSSL_PATH)/crypto/dh/dh_rfc5114.c >> + $(OPENSSL_PATH)/crypto/dh/dh_rfc7919.c >> $(OPENSSL_PATH)/crypto/dso/dso_dl.c >> $(OPENSSL_PATH)/crypto/dso/dso_dlfcn.c >> $(OPENSSL_PATH)/crypto/dso/dso_err.c >> @@ -228,6 +231,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/evp/e_aes.c >> $(OPENSSL_PATH)/crypto/evp/e_aes_cbc_hmac_sha1.c >> $(OPENSSL_PATH)/crypto/evp/e_aes_cbc_hmac_sha256.c >> + $(OPENSSL_PATH)/crypto/evp/e_aria.c >> $(OPENSSL_PATH)/crypto/evp/e_bf.c >> $(OPENSSL_PATH)/crypto/evp/e_camellia.c >> $(OPENSSL_PATH)/crypto/evp/e_cast.c >> @@ -242,6 +246,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/evp/e_rc4_hmac_md5.c >> $(OPENSSL_PATH)/crypto/evp/e_rc5.c >> $(OPENSSL_PATH)/crypto/evp/e_seed.c >> + $(OPENSSL_PATH)/crypto/evp/e_sm4.c >> $(OPENSSL_PATH)/crypto/evp/e_xcbc_d.c >> $(OPENSSL_PATH)/crypto/evp/encode.c >> $(OPENSSL_PATH)/crypto/evp/evp_cnf.c >> @@ -259,6 +264,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/evp/m_null.c >> $(OPENSSL_PATH)/crypto/evp/m_ripemd.c >> $(OPENSSL_PATH)/crypto/evp/m_sha1.c >> + $(OPENSSL_PATH)/crypto/evp/m_sha3.c >> $(OPENSSL_PATH)/crypto/evp/m_sigver.c >> $(OPENSSL_PATH)/crypto/evp/m_wp.c >> $(OPENSSL_PATH)/crypto/evp/names.c >> @@ -271,10 +277,10 @@ [Sources] >> $(OPENSSL_PATH)/crypto/evp/p_seal.c >> $(OPENSSL_PATH)/crypto/evp/p_sign.c >> $(OPENSSL_PATH)/crypto/evp/p_verify.c >> + $(OPENSSL_PATH)/crypto/evp/pbe_scrypt.c >> $(OPENSSL_PATH)/crypto/evp/pmeth_fn.c >> $(OPENSSL_PATH)/crypto/evp/pmeth_gn.c >> $(OPENSSL_PATH)/crypto/evp/pmeth_lib.c >> - $(OPENSSL_PATH)/crypto/evp/scrypt.c >> $(OPENSSL_PATH)/crypto/ex_data.c >> $(OPENSSL_PATH)/crypto/getenv.c >> $(OPENSSL_PATH)/crypto/hmac/hm_ameth.c >> @@ -283,6 +289,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/init.c >> $(OPENSSL_PATH)/crypto/kdf/hkdf.c >> $(OPENSSL_PATH)/crypto/kdf/kdf_err.c >> + $(OPENSSL_PATH)/crypto/kdf/scrypt.c >> $(OPENSSL_PATH)/crypto/kdf/tls1_prf.c >> $(OPENSSL_PATH)/crypto/lhash/lh_stats.c >> $(OPENSSL_PATH)/crypto/lhash/lhash.c >> @@ -360,14 +367,14 @@ [Sources] >> $(OPENSSL_PATH)/crypto/pkcs7/pk7_mime.c >> $(OPENSSL_PATH)/crypto/pkcs7/pk7_smime.c >> $(OPENSSL_PATH)/crypto/pkcs7/pkcs7err.c >> - $(OPENSSL_PATH)/crypto/rand/md_rand.c >> + $(OPENSSL_PATH)/crypto/rand/drbg_ctr.c >> + $(OPENSSL_PATH)/crypto/rand/drbg_lib.c >> $(OPENSSL_PATH)/crypto/rand/rand_egd.c >> $(OPENSSL_PATH)/crypto/rand/rand_err.c >> $(OPENSSL_PATH)/crypto/rand/rand_lib.c >> $(OPENSSL_PATH)/crypto/rand/rand_unix.c >> $(OPENSSL_PATH)/crypto/rand/rand_vms.c >> $(OPENSSL_PATH)/crypto/rand/rand_win.c >> - $(OPENSSL_PATH)/crypto/rand/randfile.c >> $(OPENSSL_PATH)/crypto/rc4/rc4_enc.c >> $(OPENSSL_PATH)/crypto/rc4/rc4_skey.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_ameth.c >> @@ -379,8 +386,8 @@ [Sources] >> $(OPENSSL_PATH)/crypto/rsa/rsa_gen.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_lib.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_meth.c >> + $(OPENSSL_PATH)/crypto/rsa/rsa_mp.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_none.c >> - $(OPENSSL_PATH)/crypto/rsa/rsa_null.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_oaep.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_ossl.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_pk1.c >> @@ -392,15 +399,27 @@ [Sources] >> $(OPENSSL_PATH)/crypto/rsa/rsa_ssl.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_x931.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_x931g.c >> + $(OPENSSL_PATH)/crypto/sha/keccak1600.c >> $(OPENSSL_PATH)/crypto/sha/sha1_one.c >> $(OPENSSL_PATH)/crypto/sha/sha1dgst.c >> $(OPENSSL_PATH)/crypto/sha/sha256.c >> $(OPENSSL_PATH)/crypto/sha/sha512.c >> + $(OPENSSL_PATH)/crypto/siphash/siphash.c >> + $(OPENSSL_PATH)/crypto/siphash/siphash_ameth.c >> + $(OPENSSL_PATH)/crypto/siphash/siphash_pmeth.c >> + $(OPENSSL_PATH)/crypto/sm3/m_sm3.c >> + $(OPENSSL_PATH)/crypto/sm3/sm3.c >> + $(OPENSSL_PATH)/crypto/sm4/sm4.c >> $(OPENSSL_PATH)/crypto/stack/stack.c >> $(OPENSSL_PATH)/crypto/threads_none.c >> $(OPENSSL_PATH)/crypto/threads_pthread.c >> $(OPENSSL_PATH)/crypto/threads_win.c >> $(OPENSSL_PATH)/crypto/txt_db/txt_db.c >> + $(OPENSSL_PATH)/crypto/ui/ui_err.c >> + $(OPENSSL_PATH)/crypto/ui/ui_lib.c >> + $(OPENSSL_PATH)/crypto/ui/ui_null.c >> + $(OPENSSL_PATH)/crypto/ui/ui_openssl.c >> + $(OPENSSL_PATH)/crypto/ui/ui_util.c >> $(OPENSSL_PATH)/crypto/uid.c >> $(OPENSSL_PATH)/crypto/x509/by_dir.c >> $(OPENSSL_PATH)/crypto/x509/by_file.c >> @@ -445,6 +464,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/x509v3/pcy_node.c >> $(OPENSSL_PATH)/crypto/x509v3/pcy_tree.c >> $(OPENSSL_PATH)/crypto/x509v3/v3_addr.c >> + $(OPENSSL_PATH)/crypto/x509v3/v3_admis.c >> $(OPENSSL_PATH)/crypto/x509v3/v3_akey.c >> $(OPENSSL_PATH)/crypto/x509v3/v3_akeya.c >> $(OPENSSL_PATH)/crypto/x509v3/v3_alt.c >> @@ -476,12 +496,29 @@ [Sources] >> $(OPENSSL_PATH)/crypto/x509v3/v3err.c >> # Autogenerated files list ends here >> >> + ossl_store.c >> + rand_pool.c >> + >> +[Sources.Ia32] >> + rand_pool_noise_tsc.c >> + >> +[Sources.X64] >> + rand_pool_noise_tsc.c >> + >> +[Sources.ARM] >> + rand_pool_noise.c >> + >> +[Sources.AARCH64] >> + rand_pool_noise.c >> + >> [Packages] >> MdePkg/MdePkg.dec >> CryptoPkg/CryptoPkg.dec >> >> [LibraryClasses] >> + BaseLib >> DebugLib >> + TimerLib >> >> [LibraryClasses.ARM] >> ArmSoftFloatLib >> diff --git a/CryptoPkg/Library/Include/CrtLibSupport.h >> b/CryptoPkg/Library/Include/CrtLibSupport.h >> index b05c5d908ce2..5806f50f7485 100644 >> --- a/CryptoPkg/Library/Include/CrtLibSupport.h >> +++ b/CryptoPkg/Library/Include/CrtLibSupport.h >> @@ -2,7 +2,7 @@ >> Root include file of C runtime library to support building the third-party >> cryptographic library. >> >> -Copyright (c) 2010 - 2017, Intel Corporation. All rights >> reserved.<BR> >> +Copyright (c) 2010 - 2019, Intel Corporation. All rights >> +reserved.<BR> >> SPDX-License-Identifier: BSD-2-Clause-Patent >> >> **/ >> @@ -21,6 +21,17 @@ SPDX-License-Identifier: BSD-2-Clause-Patent >> #define MAX_STRING_SIZE 0x1000 >> >> // >> +// We already have "no-ui" in out Configure invocation. >> +// but the code still fails to compile. >> +// Ref: https://github.com/openssl/openssl/issues/8904 >> +// >> +// This is defined in CRT library(stdio.h). >> +// >> +#ifndef BUFSIZ >> +#define BUFSIZ 8192 >> +#endif >> + >> +// >> // OpenSSL relies on explicit configuration for word size in >> crypto/bn, // but we want it to be automatically inferred from the >> target. So we // bypass what's in <openssl/opensslconf.h> for >> OPENSSL_SYS_UEFI, and diff --git >> a/CryptoPkg/Library/Include/openssl/opensslconf.h >> b/CryptoPkg/Library/Include/openssl/opensslconf.h >> index 28dd9ab93c61..07fa2d3ce280 100644 >> --- a/CryptoPkg/Library/Include/openssl/opensslconf.h >> +++ b/CryptoPkg/Library/Include/openssl/opensslconf.h >> @@ -10,6 +10,8 @@ >> * https://www.openssl.org/source/license.html >> */ >> >> +#include <openssl/opensslv.h> >> + >> #ifdef __cplusplus >> extern "C" { >> #endif >> @@ -77,18 +79,21 @@ extern "C" { >> #ifndef OPENSSL_NO_SEED >> # define OPENSSL_NO_SEED >> #endif >> +#ifndef OPENSSL_NO_SM2 >> +# define OPENSSL_NO_SM2 >> +#endif >> #ifndef OPENSSL_NO_SRP >> # define OPENSSL_NO_SRP >> #endif >> #ifndef OPENSSL_NO_TS >> # define OPENSSL_NO_TS >> #endif >> -#ifndef OPENSSL_NO_UI >> -# define OPENSSL_NO_UI >> -#endif >> #ifndef OPENSSL_NO_WHIRLPOOL >> # define OPENSSL_NO_WHIRLPOOL >> #endif >> +#ifndef OPENSSL_RAND_SEED_NONE >> +# define OPENSSL_RAND_SEED_NONE >> +#endif >> #ifndef OPENSSL_NO_AFALGENG >> # define OPENSSL_NO_AFALGENG >> #endif >> @@ -122,6 +127,9 @@ extern "C" { >> #ifndef OPENSSL_NO_DEPRECATED >> # define OPENSSL_NO_DEPRECATED >> #endif >> +#ifndef OPENSSL_NO_DEVCRYPTOENG >> +# define OPENSSL_NO_DEVCRYPTOENG >> +#endif >> #ifndef OPENSSL_NO_DGRAM >> # define OPENSSL_NO_DGRAM >> #endif >> @@ -155,6 +163,9 @@ extern "C" { >> #ifndef OPENSSL_NO_ERR >> # define OPENSSL_NO_ERR >> #endif >> +#ifndef OPENSSL_NO_EXTERNAL_TESTS >> +# define OPENSSL_NO_EXTERNAL_TESTS >> +#endif >> #ifndef OPENSSL_NO_FILENAMES >> # define OPENSSL_NO_FILENAMES >> #endif >> @@ -209,15 +220,24 @@ extern "C" { >> #ifndef OPENSSL_NO_TESTS >> # define OPENSSL_NO_TESTS >> #endif >> +#ifndef OPENSSL_NO_TLS1_3 >> +# define OPENSSL_NO_TLS1_3 >> +#endif >> #ifndef OPENSSL_NO_UBSAN >> # define OPENSSL_NO_UBSAN >> #endif >> +#ifndef OPENSSL_NO_UI_CONSOLE >> +# define OPENSSL_NO_UI_CONSOLE >> +#endif >> #ifndef OPENSSL_NO_UNIT_TEST >> # define OPENSSL_NO_UNIT_TEST >> #endif >> #ifndef OPENSSL_NO_WEAK_SSL_CIPHERS >> # define OPENSSL_NO_WEAK_SSL_CIPHERS >> #endif >> +#ifndef OPENSSL_NO_DYNAMIC_ENGINE >> +# define OPENSSL_NO_DYNAMIC_ENGINE >> +#endif >> #ifndef OPENSSL_NO_AFALGENG >> # define OPENSSL_NO_AFALGENG >> #endif >> @@ -236,15 +256,11 @@ extern "C" { >> * functions. >> */ >> #ifndef DECLARE_DEPRECATED >> -# if defined(OPENSSL_NO_DEPRECATED) >> -# define DECLARE_DEPRECATED(f) >> -# else >> -# define DECLARE_DEPRECATED(f) f; >> -# ifdef __GNUC__ >> -# if __GNUC__ > 3 || (__GNUC__ == 3 && __GNUC_MINOR__ > 0) >> -# undef DECLARE_DEPRECATED >> -# define DECLARE_DEPRECATED(f) f __attribute__ ((deprecated)); >> -# endif >> +# define DECLARE_DEPRECATED(f) f; >> +# ifdef __GNUC__ >> +# if __GNUC__ > 3 || (__GNUC__ == 3 && __GNUC_MINOR__ > 0) >> +# undef DECLARE_DEPRECATED >> +# define DECLARE_DEPRECATED(f) f __attribute__ ((deprecated)); >> # endif >> # endif >> #endif >> @@ -268,6 +284,18 @@ extern "C" { >> # define OPENSSL_API_COMPAT OPENSSL_MIN_API #endif >> >> +/* >> + * Do not deprecate things to be deprecated in version 1.2.0 before >> +the >> + * OpenSSL version number matches. >> + */ >> +#if OPENSSL_VERSION_NUMBER < 0x10200000L >> +# define DEPRECATEDIN_1_2_0(f) f; >> +#elif OPENSSL_API_COMPAT < 0x10200000L >> +# define DEPRECATEDIN_1_2_0(f) DECLARE_DEPRECATED(f) >> +#else >> +# define DEPRECATEDIN_1_2_0(f) >> +#endif >> + >> #if OPENSSL_API_COMPAT < 0x10100000L >> # define DEPRECATEDIN_1_1_0(f) DECLARE_DEPRECATED(f) >> #else >> @@ -286,8 +314,6 @@ extern "C" { >> # define DEPRECATEDIN_0_9_8(f) >> #endif >> >> - >> - >> /* Generate 80386 code? */ >> #undef I386_ONLY >> >> diff --git a/CryptoPkg/Library/OpensslLib/buildinf.h >> b/CryptoPkg/Library/OpensslLib/buildinf.h >> index c5ca293c729f..b840c8656a28 100644 >> --- a/CryptoPkg/Library/OpensslLib/buildinf.h >> +++ b/CryptoPkg/Library/OpensslLib/buildinf.h >> @@ -1,2 +1,4 @@ >> #define PLATFORM "UEFI" >> #define DATE "Fri Dec 22 01:23:45 PDT 2017" >> + >> +const char * compiler_flags = "compiler: information not available >> +from edk2"; >> diff --git a/CryptoPkg/Library/OpensslLib/rand_pool_noise.h >> b/CryptoPkg/Library/OpensslLib/rand_pool_noise.h >> new file mode 100644 >> index 000000000000..75acc686a9f1 >> --- /dev/null >> +++ b/CryptoPkg/Library/OpensslLib/rand_pool_noise.h >> @@ -0,0 +1,29 @@ >> +/** @file >> + Provide rand noise source. >> + >> +Copyright (c) 2019, Intel Corporation. All rights reserved.<BR> >> +SPDX-License-Identifier: BSD-2-Clause-Patent >> + >> +**/ >> + >> +#ifndef __RAND_POOL_NOISE_H__ >> +#define __RAND_POOL_NOISE_H__ >> + >> +#include <Uefi/UefiBaseType.h> >> + >> +/** >> + Get 64-bit noise source. >> + >> + @param[out] Rand Buffer pointer to store 64-bit noise source >> + >> + @retval TRUE Get randomness successfully. >> + @retval FALSE Failed to generate >> +**/ >> +BOOLEAN >> +EFIAPI >> +GetRandomNoise64 ( >> + OUT UINT64 *Rand >> + ); >> + >> + >> +#endif // __RAND_POOL_NOISE_H__ >> diff --git a/CryptoPkg/Library/OpensslLib/ossl_store.c >> b/CryptoPkg/Library/OpensslLib/ossl_store.c >> new file mode 100644 >> index 000000000000..29e1506048e3 >> --- /dev/null >> +++ b/CryptoPkg/Library/OpensslLib/ossl_store.c >> @@ -0,0 +1,17 @@ >> +/** @file >> + Dummy implement ossl_store(Store retrieval functions) for UEFI. >> + >> +Copyright (c) 2019, Intel Corporation. All rights reserved.<BR> >> +SPDX-License-Identifier: BSD-2-Clause-Patent >> + >> +**/ >> + >> +/* >> + * This function is cleanup ossl store. >> + * >> + * Dummy Implement for UEFI >> + */ >> +void ossl_store_cleanup_int(void) >> +{ >> +} >> + >> diff --git a/CryptoPkg/Library/OpensslLib/rand_pool.c >> b/CryptoPkg/Library/OpensslLib/rand_pool.c >> new file mode 100644 >> index 000000000000..9d2a4ad13823 >> --- /dev/null >> +++ b/CryptoPkg/Library/OpensslLib/rand_pool.c >> @@ -0,0 +1,316 @@ >> +/** @file >> + OpenSSL_1_1_1b doesn't implement rand_pool_* functions for UEFI. >> + The file implement these functions. >> + >> +Copyright (c) 2019, Intel Corporation. All rights reserved.<BR> >> +SPDX-License-Identifier: BSD-2-Clause-Patent >> + >> +**/ >> + >> +#include "internal/rand_int.h" >> +#include <openssl/aes.h> >> + >> +#include <Uefi.h> >> +#include <Library/TimerLib.h> >> + >> +#include "rand_pool_noise.h" >> + >> +/** >> + Get some randomness from low-order bits of GetPerformanceCounter results. >> + And combine them to the 64-bit value >> + >> + @param[out] Rand Buffer pointer to store the 64-bit random value. >> + >> + @retval TRUE Random number generated successfully. >> + @retval FALSE Failed to generate. >> +**/ >> +STATIC >> +BOOLEAN >> +EFIAPI >> +GetRandNoise64FromPerformanceCounter( >> + OUT UINT64 *Rand >> + ) >> +{ >> + UINT32 Index; >> + UINT32 *RandPtr; >> + >> + if (NULL == Rand) { >> + return FALSE; >> + } >> + >> + RandPtr = (UINT32 *) Rand; >> + >> + for (Index = 0; Index < 2; Index ++) { >> + *RandPtr = (UINT32) (GetPerformanceCounter () & 0xFF); >> + MicroSecondDelay (10); >> + RandPtr++; >> + } >> + >> + return TRUE; >> +} >> + >> +/** >> + Calls RandomNumber64 to fill >> + a buffer of arbitrary size with random bytes. >> + >> + @param[in] Length Size of the buffer, in bytes, to fill with. >> + @param[out] RandBuffer Pointer to the buffer to store the random result. >> + >> + @retval EFI_SUCCESS Random bytes generation succeeded. >> + @retval EFI_NOT_READY Failed to request random bytes. >> + >> +**/ >> +STATIC >> +BOOLEAN >> +EFIAPI >> +RandGetBytes ( >> + IN UINTN Length, >> + OUT UINT8 *RandBuffer >> + ) >> +{ >> + BOOLEAN Ret; >> + UINT64 TempRand; >> + >> + Ret = FALSE; >> + >> + while (Length > 0) { >> + // >> + // Get random noise from platform. >> + // If it failed, fallback to PerformanceCounter >> + // If you really care about security, you must override >> + // GetRandomNoise64FromPlatform. >> + // >> + Ret = GetRandomNoise64 (&TempRand); >> + if (Ret == FALSE) { >> + Ret = GetRandNoise64FromPerformanceCounter (&TempRand); >> + } >> + if (!Ret) { >> + return Ret; >> + } >> + if (Length >= sizeof (TempRand)) { >> + *((UINT64*) RandBuffer) = TempRand; >> + RandBuffer += sizeof (UINT64); >> + Length -= sizeof (TempRand); >> + } else { >> + CopyMem (RandBuffer, &TempRand, Length); >> + Length = 0; >> + } >> + } >> + >> + return Ret; >> +} >> + >> +/** >> + Creates a 128bit random value that is fully forward and backward >> +prediction resistant, >> + suitable for seeding a NIST SP800-90 Compliant. >> + This function takes multiple random numbers from PerformanceCounter >> +to ensure reseeding >> + and performs AES-CBC-MAC over the data to compute the seed value. >> + >> + @param[out] SeedBuffer Pointer to a 128bit buffer to store the random seed. >> + >> + @retval TRUE Random seed generation succeeded. >> + @retval FALSE Failed to request random bytes. >> + >> +**/ >> +STATIC >> +BOOLEAN >> +EFIAPI >> +RandGetSeed128 ( >> + OUT UINT8 *SeedBuffer >> + ) >> +{ >> + BOOLEAN Ret; >> + UINT8 RandByte[16]; >> + UINT8 Key[16]; >> + UINT8 Ffv[16]; >> + UINT8 Xored[16]; >> + UINT32 Index; >> + UINT32 Index2; >> + AES_KEY AESKey; >> + >> + // >> + // Chose an arbitary key and zero the feed_forward_value (FFV) // >> + for (Index = 0; Index < 16; Index++) { >> + Key[Index] = (UINT8) Index; >> + Ffv[Index] = 0; >> + } >> + >> + AES_set_encrypt_key (Key, 16 * 8, &AESKey); >> + >> + // >> + // Perform CBC_MAC over 32 * 128 bit values, with 10us gaps between >> + 128 bit value // The 10us gaps will ensure multiple reseeds within >> + the system time with a large // design margin. >> + // >> + for (Index = 0; Index < 32; Index++) { >> + MicroSecondDelay (10); >> + Ret = RandGetBytes (16, RandByte); >> + if (!Ret) { >> + return Ret; >> + } >> + >> + // >> + // Perform XOR operations on two 128-bit value. >> + // >> + for (Index2 = 0; Index2 < 16; Index2++) { >> + Xored[Index2] = RandByte[Index2] ^ Ffv[Index2]; >> + } >> + >> + AES_encrypt (Xored, Ffv, &AESKey); } >> + >> + for (Index = 0; Index < 16; Index++) { >> + SeedBuffer[Index] = Ffv[Index]; >> + } >> + >> + return Ret; >> +} >> + >> +/** >> + Generate high-quality entropy source. >> + >> + @param[in] Length Size of the buffer, in bytes, to fill with. >> + @param[out] Entropy Pointer to the buffer to store the entropy data. >> + >> + @retval EFI_SUCCESS Entropy generation succeeded. >> + @retval EFI_NOT_READY Failed to request random data. >> + >> +**/ >> +STATIC >> +BOOLEAN >> +EFIAPI >> +RandGenerateEntropy ( >> + IN UINTN Length, >> + OUT UINT8 *Entropy >> + ) >> +{ >> + BOOLEAN Ret; >> + UINTN BlockCount; >> + UINT8 Seed[16]; >> + UINT8 *Ptr; >> + >> + BlockCount = Length / 16; >> + Ptr = (UINT8 *) Entropy; >> + >> + // >> + // Generate high-quality seed for DRBG Entropy // while >> + (BlockCount > 0) { >> + Ret = RandGetSeed128 (Seed); >> + if (!Ret) { >> + return Ret; >> + } >> + CopyMem (Ptr, Seed, 16); >> + >> + BlockCount--; >> + Ptr = Ptr + 16; >> + } >> + >> + // >> + // Populate the remained data as request. >> + // >> + Ret = RandGetSeed128 (Seed); >> + if (!Ret) { >> + return Ret; >> + } >> + CopyMem (Ptr, Seed, (Length % 16)); >> + >> + return Ret; >> +} >> + >> +/* >> + * Add random bytes to the pool to acquire requested amount of >> +entropy >> + * >> + * This function is platform specific and tries to acquire the >> +requested >> + * amount of entropy by polling platform specific entropy sources. >> + * >> + * This is OpenSSL required interface. >> + */ >> +size_t rand_pool_acquire_entropy(RAND_POOL *pool) { >> + BOOLEAN Ret; >> + size_t bytes_needed; >> + unsigned char * buffer; >> + >> + bytes_needed = rand_pool_bytes_needed(pool, 1 /*entropy_factor*/); >> + if (bytes_needed > 0) { >> + buffer = rand_pool_add_begin(pool, bytes_needed); >> + >> + if (buffer != NULL) { >> + Ret = RandGenerateEntropy(bytes_needed, buffer); >> + if (FALSE == Ret) { >> + rand_pool_add_end(pool, 0, 0); >> + } else { >> + rand_pool_add_end(pool, bytes_needed, 8 * bytes_needed); >> + } >> + } >> + } >> + >> + return rand_pool_entropy_available(pool); >> +} >> + >> +/* >> + * Implementation for UEFI >> + * >> + * This is OpenSSL required interface. >> + */ >> +int rand_pool_add_nonce_data(RAND_POOL *pool) { >> + struct { >> + UINT64 Rand; >> + UINT64 TimerValue; >> + } data = { 0 }; >> + >> + RandGetBytes(8, (UINT8 *)&(data.Rand)); data.TimerValue = >> + GetPerformanceCounter(); >> + >> + return rand_pool_add(pool, (unsigned char*)&data, sizeof(data), 0); >> +} >> + >> +/* >> + * Implementation for UEFI >> + * >> + * This is OpenSSL required interface. >> + */ >> +int rand_pool_add_additional_data(RAND_POOL *pool) { >> + struct { >> + UINT64 Rand; >> + UINT64 TimerValue; >> + } data = { 0 }; >> + >> + RandGetBytes(8, (UINT8 *)&(data.Rand)); data.TimerValue = >> + GetPerformanceCounter(); >> + >> + return rand_pool_add(pool, (unsigned char*)&data, sizeof(data), 0); >> +} >> + >> +/* >> + * Dummy Implememtation for UEFI >> + * >> + * This is OpenSSL required interface. >> + */ >> +int rand_pool_init(void) >> +{ >> + return 1; >> +} >> + >> +/* >> + * Dummy Implememtation for UEFI >> + * >> + * This is OpenSSL required interface. >> + */ >> +void rand_pool_cleanup(void) >> +{ >> +} >> + >> +/* >> + * Dummy Implememtation for UEFI >> + * >> + * This is OpenSSL required interface. >> + */ >> +void rand_pool_keep_random_devices_open(int keep) { } >> + >> diff --git a/CryptoPkg/Library/OpensslLib/rand_pool_noise.c >> b/CryptoPkg/Library/OpensslLib/rand_pool_noise.c >> new file mode 100644 >> index 000000000000..c16ed8b45496 >> --- /dev/null >> +++ b/CryptoPkg/Library/OpensslLib/rand_pool_noise.c >> @@ -0,0 +1,29 @@ >> +/** @file >> + Provide rand noise source. >> + >> +Copyright (c) 2019, Intel Corporation. All rights reserved.<BR> >> +SPDX-License-Identifier: BSD-2-Clause-Patent >> + >> +**/ >> + >> +#include <Library/BaseLib.h> >> + >> +/** >> + Get 64-bit noise source >> + >> + @param[out] Rand Buffer pointer to store 64-bit noise source >> + >> + @retval FALSE Failed to generate >> +**/ >> +BOOLEAN >> +EFIAPI >> +GetRandomNoise64 ( >> + OUT UINT64 *Rand >> + ) >> +{ >> + // >> + // Return FALSE will fallback to use PerformaceCounter to >> + // generate noise. >> + // >> + return FALSE; >> +} >> diff --git a/CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c >> b/CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c >> new file mode 100644 >> index 000000000000..4158106231fd >> --- /dev/null >> +++ b/CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c >> @@ -0,0 +1,43 @@ >> +/** @file >> + Provide rand noise source. >> + >> +Copyright (c) 2019, Intel Corporation. All rights reserved.<BR> >> +SPDX-License-Identifier: BSD-2-Clause-Patent >> + >> +**/ >> + >> +#include <Library/BaseLib.h> >> +#include <Library/DebugLib.h> >> +#include <Library/TimerLib.h> >> + >> +/** >> + Get 64-bit noise source >> + >> + @param[out] Rand Buffer pointer to store 64-bit noise source >> + >> + @retval TRUE Get randomness successfully. >> + @retval FALSE Failed to generate >> +**/ >> +BOOLEAN >> +EFIAPI >> +GetRandomNoise64 ( >> + OUT UINT64 *Rand >> + ) >> +{ >> + UINT32 Index; >> + UINT32 *RandPtr; >> + >> + if (NULL == Rand) { >> + return FALSE; >> + } >> + >> + RandPtr = (UINT32 *)Rand; >> + >> + for (Index = 0; Index < 2; Index ++) { >> + *RandPtr = (UINT32) ((AsmReadTsc ()) & 0xFF); >> + RandPtr++; >> + MicroSecondDelay (10); >> + } >> + >> + return TRUE; >> +} >> diff --git a/CryptoPkg/Library/OpensslLib/openssl >> b/CryptoPkg/Library/OpensslLib/openssl >> index 74f2d9c1ec5f..50eaac9f3337 160000 >> --- a/CryptoPkg/Library/OpensslLib/openssl >> +++ b/CryptoPkg/Library/OpensslLib/openssl >> @@ -1 +1 @@ >> -Subproject commit 74f2d9c1ec5f5510e1d3da5a9f03c28df0977762 >> +Subproject commit 50eaac9f3337667259de725451f201e784599687 >> > ^ permalink raw reply [flat|nested] 39+ messages in thread
* Re: [edk2-devel] [PATCH v4 6/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b 2019-05-17 13:15 ` Laszlo Ersek @ 2019-05-18 7:16 ` Xiaoyu Lu 0 siblings, 0 replies; 39+ messages in thread From: Xiaoyu Lu @ 2019-05-18 7:16 UTC (permalink / raw) To: Laszlo Ersek, devel@edk2.groups.io, Wang, Jian J Laszlo, >>On 05/17/19 13:14, Lu, XiaoyuX wrote: >> Laszlo, >> >> I think (b) is better and have already done this. > >What do you mean by "already done"? In your personal development tree perhaps? Yes. https://github.com/xiaoyuxlu/edk2/tree/bz_1089_upgrade_to_openssl_1_1_1b_v5_wip Thanks Xiaoyu -----Original Message----- From: Laszlo Ersek [mailto:lersek@redhat.com] Sent: Friday, May 17, 2019 9:16 PM To: Lu, XiaoyuX <xiaoyux.lu@intel.com>; devel@edk2.groups.io; Wang, Jian J <jian.j.wang@intel.com> Cc: Ye, Ting <ting.ye@intel.com> Subject: Re: [edk2-devel] [PATCH v4 6/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b On 05/17/19 13:14, Lu, XiaoyuX wrote: > Laszlo, > > I think (b) is better and have already done this. What do you mean by "already done"? In your personal development tree perhaps? > About (b/1): > > One the one hand, the implementation still need discuss later. > On the other hand: > > Refer to openssl/INSTALL the meaning of --with-rand-seed=none > > > none: Disable automatic seeding. This is the default > > on some operating systems where no suitable > > entropy source exists, or no support for it is > > implemented yet. > > I think when --with-rand-seed=none option is set, the best way to implement rand_pool_acquire_entropy should like this: > >> size_t rand_pool_acquire_entropy(RAND_POOL *pool) { return >> rand_pool_entropy_available(pool); >> } >> >> int rand_pool_add_nonce_data(RAND_POOL *pool) { // I think >> PerformanceCounter is an optional nonce. >> UINT64 data; >> data = GetPerformanceCounter(); >> >> return rand_pool_add(pool, (unsigned char*)&data, sizeof(data), >> 0);>} >> >> int rand_pool_add_additional_data(RAND_POOL *pool) { return 0; } > > With this, we handed the Rand_seed work to caller. (caller must provide safe seed). > > What do you think? Sorry, no idea. Thanks Laszlo > > Thanks, > Xiaoyu > > -----Original Message----- > From: Laszlo Ersek [mailto:lersek@redhat.com] > Sent: Friday, May 17, 2019 12:32 AM > To: devel@edk2.groups.io; Lu, XiaoyuX <xiaoyux.lu@intel.com>; Wang, > Jian J <jian.j.wang@intel.com> > Cc: Ye, Ting <ting.ye@intel.com> > Subject: Re: [edk2-devel] [PATCH v4 6/7] CryptoPkg: Upgrade OpenSSL to > 1.1.1b > > Hi Jian, > > On 05/16/19 09:54, Xiaoyu lu wrote: >> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1089 >> >> * Update OpenSSL submodule to OpenSSL_1_1_1b >> OpenSSL_1_1_1b(50eaac9f3337667259de725451f201e784599687) >> >> * Run process_files.pl script to regenerate OpensslLib[Crypto].inf >> and opensslconf.h >> >> * Remove -DNO_SYSLOG from OPENSSL_FLAGS in OpensslLib[Crypto].inf, >> due to upstream OpenSSL commit cff55b90e95e("Cleaning UEFI >> Build with additional OPENSSL_SYS_UEFI flags", 2017-03-29), >> which was first released as part of OpenSSL_1_1_1. >> >> * Starting with OpenSSL commit 8a8d9e1905(first release in >> OpenSSL_1_1_1), the OpenSSL_version() function can no longer >> return a pointer to the string literal "compiler: information >> not available", in the case CFLAGS macro is not defined. >> Instead, the function now has a hard dependency on the global >> variable 'compiler_flags'. This variable is normally placed >> by "util/mkbuildinf.pl" into "buildinf.h". In edk2 we don't >> run that script whenever we build OpenSSL, therefore we >> must provide our own dummy 'compiler_flags'. >> >> * From OpenSSL_1_1_0i(97c0959f27b294fe1eb10b547145ebef2524b896) to >> OpenSSL_1_1_1b(50eaac9f3337667259de725451f201e784599687), OpenSSL >> updated DRBG / RAND to request nonce and additional low entropy >> randomness from system(line 229 openssl/CHANGES). >> >> Since OpenSSL_1_1_1b doesn't fully implement rand pool functions >> for UEFI. We must provide a method to implenet these method. >> TSC is used as first entropy source if it's availabe otherwise >> fallback to TimerLib. But we are not sure the amount of randomness >> they provide. If you really care about the security, one choice is >> overrided it with hardware generator. >> >> Add rand_pool.c to implement these functions required by OpenSSL >> rand_pool_acquire_entropy >> rand_pool_add_nonce_data >> rand_pool_add_additional_data >> rand_pool_init >> rand_pool_cleanup >> rand_pool_keep_random_devices_open >> >> And add rand_pool_noise.* for getting entropy noise from different >> architecture. >> >> * We don't need ossl_store functions. We exclude relative files >> through process_files.pl. And ossl_store_cleanup_int was first >> added in crypto/init.c OpenSSL_1_1_1(71a5516d). >> So add a new file(ossl_store.c) to implement ossl_store_cleanup_int >> function. >> >> * BUFSIZ is used by crypto/evp/evp_key.c(OpenSSL_1_1_1b) >> And it is declared in stdio.h. So add it to CrtLibSupport.h. >> Here's a discussion about this. >> Ref: https://github.com/openssl/openssl/issues/8904 >> >> Cc: Jian J Wang <jian.j.wang@intel.com> >> Cc: Ting Ye <ting.ye@intel.com> >> Signed-off-by: Xiaoyu Lu <xiaoyux.lu@intel.com> >> --- >> CryptoPkg/Library/OpensslLib/OpensslLib.inf | 60 +++- >> CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 51 +++- >> CryptoPkg/Library/Include/CrtLibSupport.h | 13 +- >> CryptoPkg/Library/Include/openssl/opensslconf.h | 54 +++- >> CryptoPkg/Library/OpensslLib/buildinf.h | 2 + >> CryptoPkg/Library/OpensslLib/rand_pool_noise.h | 29 ++ >> CryptoPkg/Library/OpensslLib/ossl_store.c | 17 ++ >> CryptoPkg/Library/OpensslLib/rand_pool.c | 316 +++++++++++++++++++++ >> CryptoPkg/Library/OpensslLib/rand_pool_noise.c | 29 ++ >> CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c | 43 +++ >> CryptoPkg/Library/OpensslLib/openssl | 2 +- >> 11 files changed, 584 insertions(+), 32 deletions(-) create mode >> 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.h >> create mode 100644 CryptoPkg/Library/OpensslLib/ossl_store.c >> create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool.c >> create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.c >> create mode 100644 >> CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c > > For this patch, I can offer two kinds of reviews: > > ---*--- > > (a) If you prefer to push this patch in the present form (that is, exactly as posted), then I will not give any official feedback tags, due to the crypto contents. I will not block the patch either, so if you and Ting are fine with the patch, it's OK for you to push it, from my side. > > ---*--- > > (b) Alternatively, you could split the patch in two halves, as follows: > > (b/1) In the first half, collect all the hunks for the following files: > > CryptoPkg/Library/OpensslLib/ossl_store.c > CryptoPkg/Library/OpensslLib/rand_pool.c > CryptoPkg/Library/OpensslLib/rand_pool_noise.c > CryptoPkg/Library/OpensslLib/rand_pool_noise.h > CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c > > plus include the commit message paragraphs about "rand_pool.c" and "ossl_store.c". > > For this half (b/1), I will not give any feedback. > > > (b/2) In the second half, collect the rest of the changes, that is, > the hunks for the following files / submodules, and the rest of the > commit > message: > > CryptoPkg/Library/Include/CrtLibSupport.h > CryptoPkg/Library/Include/openssl/opensslconf.h > CryptoPkg/Library/OpensslLib/OpensslLib.inf > CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf > CryptoPkg/Library/OpensslLib/buildinf.h > CryptoPkg/Library/OpensslLib/openssl > > For the (b/2) half *ONLY*, you can add: > > Reviewed-by: Laszlo Ersek <lersek@redhat.com> > > ---*--- > > It's up to you whether you pick (a) or (b). > > Normally I would request a v5 series for implementing (b), but we're > out of time. If the community thinks that splitting up this patch into > halves (b/1) and (b/2) is too intrusive for a maintainer to do without > proper review, then I suggest going with (a) -- and then I'll provide > no feedback tags. (But, I will also not block the patch, see above.) > > ... Well, in theory anyway, Xiaoyu could very quickly submit a v5 > series, splitting this patch as explained under (b). In that case, the > (b/2) half -- and *ONLY* that half -- of this patch could include my R-b at once. > > So, please decide. > > Thanks! > Laszlo > >> >> diff --git a/CryptoPkg/Library/OpensslLib/OpensslLib.inf >> b/CryptoPkg/Library/OpensslLib/OpensslLib.inf >> index f4d7772c068c..62dd61969cb0 100644 >> --- a/CryptoPkg/Library/OpensslLib/OpensslLib.inf >> +++ b/CryptoPkg/Library/OpensslLib/OpensslLib.inf >> @@ -1,7 +1,7 @@ >> ## @file >> # This module provides OpenSSL Library implementation. >> # >> -# Copyright (c) 2010 - 2018, Intel Corporation. All rights >> reserved.<BR> >> +# Copyright (c) 2010 - 2019, Intel Corporation. All rights >> +reserved.<BR> >> # SPDX-License-Identifier: BSD-2-Clause-Patent # ## @@ -15,7 >> +15,7 @@ [Defines] >> VERSION_STRING = 1.0 >> LIBRARY_CLASS = OpensslLib >> DEFINE OPENSSL_PATH = openssl >> - DEFINE OPENSSL_FLAGS = -DL_ENDIAN -DOPENSSL_SMALL_FOOTPRINT -D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECATE -DNO_SYSLOG >> + DEFINE OPENSSL_FLAGS = -DL_ENDIAN -DOPENSSL_SMALL_FOOTPRINT -D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECATE >> >> # >> # VALID_ARCHITECTURES = IA32 X64 ARM AARCH64 >> @@ -32,6 +32,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/aes/aes_misc.c >> $(OPENSSL_PATH)/crypto/aes/aes_ofb.c >> $(OPENSSL_PATH)/crypto/aes/aes_wrap.c >> + $(OPENSSL_PATH)/crypto/aria/aria.c >> $(OPENSSL_PATH)/crypto/asn1/a_bitstr.c >> $(OPENSSL_PATH)/crypto/asn1/a_d2i_fp.c >> $(OPENSSL_PATH)/crypto/asn1/a_digest.c >> @@ -54,6 +55,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/asn1/ameth_lib.c >> $(OPENSSL_PATH)/crypto/asn1/asn1_err.c >> $(OPENSSL_PATH)/crypto/asn1/asn1_gen.c >> + $(OPENSSL_PATH)/crypto/asn1/asn1_item_list.c >> $(OPENSSL_PATH)/crypto/asn1/asn1_lib.c >> $(OPENSSL_PATH)/crypto/asn1/asn1_par.c >> $(OPENSSL_PATH)/crypto/asn1/asn_mime.c >> @@ -172,6 +174,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/conf/conf_ssl.c >> $(OPENSSL_PATH)/crypto/cpt_err.c >> $(OPENSSL_PATH)/crypto/cryptlib.c >> + $(OPENSSL_PATH)/crypto/ctype.c >> $(OPENSSL_PATH)/crypto/cversion.c >> $(OPENSSL_PATH)/crypto/des/cbc_cksm.c >> $(OPENSSL_PATH)/crypto/des/cbc_enc.c >> @@ -189,7 +192,6 @@ [Sources] >> $(OPENSSL_PATH)/crypto/des/pcbc_enc.c >> $(OPENSSL_PATH)/crypto/des/qud_cksm.c >> $(OPENSSL_PATH)/crypto/des/rand_key.c >> - $(OPENSSL_PATH)/crypto/des/rpc_enc.c >> $(OPENSSL_PATH)/crypto/des/set_key.c >> $(OPENSSL_PATH)/crypto/des/str2key.c >> $(OPENSSL_PATH)/crypto/des/xcbc_enc.c >> @@ -206,6 +208,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/dh/dh_pmeth.c >> $(OPENSSL_PATH)/crypto/dh/dh_prn.c >> $(OPENSSL_PATH)/crypto/dh/dh_rfc5114.c >> + $(OPENSSL_PATH)/crypto/dh/dh_rfc7919.c >> $(OPENSSL_PATH)/crypto/dso/dso_dl.c >> $(OPENSSL_PATH)/crypto/dso/dso_dlfcn.c >> $(OPENSSL_PATH)/crypto/dso/dso_err.c >> @@ -228,6 +231,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/evp/e_aes.c >> $(OPENSSL_PATH)/crypto/evp/e_aes_cbc_hmac_sha1.c >> $(OPENSSL_PATH)/crypto/evp/e_aes_cbc_hmac_sha256.c >> + $(OPENSSL_PATH)/crypto/evp/e_aria.c >> $(OPENSSL_PATH)/crypto/evp/e_bf.c >> $(OPENSSL_PATH)/crypto/evp/e_camellia.c >> $(OPENSSL_PATH)/crypto/evp/e_cast.c >> @@ -242,6 +246,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/evp/e_rc4_hmac_md5.c >> $(OPENSSL_PATH)/crypto/evp/e_rc5.c >> $(OPENSSL_PATH)/crypto/evp/e_seed.c >> + $(OPENSSL_PATH)/crypto/evp/e_sm4.c >> $(OPENSSL_PATH)/crypto/evp/e_xcbc_d.c >> $(OPENSSL_PATH)/crypto/evp/encode.c >> $(OPENSSL_PATH)/crypto/evp/evp_cnf.c >> @@ -259,6 +264,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/evp/m_null.c >> $(OPENSSL_PATH)/crypto/evp/m_ripemd.c >> $(OPENSSL_PATH)/crypto/evp/m_sha1.c >> + $(OPENSSL_PATH)/crypto/evp/m_sha3.c >> $(OPENSSL_PATH)/crypto/evp/m_sigver.c >> $(OPENSSL_PATH)/crypto/evp/m_wp.c >> $(OPENSSL_PATH)/crypto/evp/names.c >> @@ -271,10 +277,10 @@ [Sources] >> $(OPENSSL_PATH)/crypto/evp/p_seal.c >> $(OPENSSL_PATH)/crypto/evp/p_sign.c >> $(OPENSSL_PATH)/crypto/evp/p_verify.c >> + $(OPENSSL_PATH)/crypto/evp/pbe_scrypt.c >> $(OPENSSL_PATH)/crypto/evp/pmeth_fn.c >> $(OPENSSL_PATH)/crypto/evp/pmeth_gn.c >> $(OPENSSL_PATH)/crypto/evp/pmeth_lib.c >> - $(OPENSSL_PATH)/crypto/evp/scrypt.c >> $(OPENSSL_PATH)/crypto/ex_data.c >> $(OPENSSL_PATH)/crypto/getenv.c >> $(OPENSSL_PATH)/crypto/hmac/hm_ameth.c >> @@ -283,6 +289,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/init.c >> $(OPENSSL_PATH)/crypto/kdf/hkdf.c >> $(OPENSSL_PATH)/crypto/kdf/kdf_err.c >> + $(OPENSSL_PATH)/crypto/kdf/scrypt.c >> $(OPENSSL_PATH)/crypto/kdf/tls1_prf.c >> $(OPENSSL_PATH)/crypto/lhash/lh_stats.c >> $(OPENSSL_PATH)/crypto/lhash/lhash.c >> @@ -360,14 +367,14 @@ [Sources] >> $(OPENSSL_PATH)/crypto/pkcs7/pk7_mime.c >> $(OPENSSL_PATH)/crypto/pkcs7/pk7_smime.c >> $(OPENSSL_PATH)/crypto/pkcs7/pkcs7err.c >> - $(OPENSSL_PATH)/crypto/rand/md_rand.c >> + $(OPENSSL_PATH)/crypto/rand/drbg_ctr.c >> + $(OPENSSL_PATH)/crypto/rand/drbg_lib.c >> $(OPENSSL_PATH)/crypto/rand/rand_egd.c >> $(OPENSSL_PATH)/crypto/rand/rand_err.c >> $(OPENSSL_PATH)/crypto/rand/rand_lib.c >> $(OPENSSL_PATH)/crypto/rand/rand_unix.c >> $(OPENSSL_PATH)/crypto/rand/rand_vms.c >> $(OPENSSL_PATH)/crypto/rand/rand_win.c >> - $(OPENSSL_PATH)/crypto/rand/randfile.c >> $(OPENSSL_PATH)/crypto/rc4/rc4_enc.c >> $(OPENSSL_PATH)/crypto/rc4/rc4_skey.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_ameth.c >> @@ -379,8 +386,8 @@ [Sources] >> $(OPENSSL_PATH)/crypto/rsa/rsa_gen.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_lib.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_meth.c >> + $(OPENSSL_PATH)/crypto/rsa/rsa_mp.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_none.c >> - $(OPENSSL_PATH)/crypto/rsa/rsa_null.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_oaep.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_ossl.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_pk1.c >> @@ -392,15 +399,27 @@ [Sources] >> $(OPENSSL_PATH)/crypto/rsa/rsa_ssl.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_x931.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_x931g.c >> + $(OPENSSL_PATH)/crypto/sha/keccak1600.c >> $(OPENSSL_PATH)/crypto/sha/sha1_one.c >> $(OPENSSL_PATH)/crypto/sha/sha1dgst.c >> $(OPENSSL_PATH)/crypto/sha/sha256.c >> $(OPENSSL_PATH)/crypto/sha/sha512.c >> + $(OPENSSL_PATH)/crypto/siphash/siphash.c >> + $(OPENSSL_PATH)/crypto/siphash/siphash_ameth.c >> + $(OPENSSL_PATH)/crypto/siphash/siphash_pmeth.c >> + $(OPENSSL_PATH)/crypto/sm3/m_sm3.c >> + $(OPENSSL_PATH)/crypto/sm3/sm3.c >> + $(OPENSSL_PATH)/crypto/sm4/sm4.c >> $(OPENSSL_PATH)/crypto/stack/stack.c >> $(OPENSSL_PATH)/crypto/threads_none.c >> $(OPENSSL_PATH)/crypto/threads_pthread.c >> $(OPENSSL_PATH)/crypto/threads_win.c >> $(OPENSSL_PATH)/crypto/txt_db/txt_db.c >> + $(OPENSSL_PATH)/crypto/ui/ui_err.c >> + $(OPENSSL_PATH)/crypto/ui/ui_lib.c >> + $(OPENSSL_PATH)/crypto/ui/ui_null.c >> + $(OPENSSL_PATH)/crypto/ui/ui_openssl.c >> + $(OPENSSL_PATH)/crypto/ui/ui_util.c >> $(OPENSSL_PATH)/crypto/uid.c >> $(OPENSSL_PATH)/crypto/x509/by_dir.c >> $(OPENSSL_PATH)/crypto/x509/by_file.c >> @@ -445,6 +464,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/x509v3/pcy_node.c >> $(OPENSSL_PATH)/crypto/x509v3/pcy_tree.c >> $(OPENSSL_PATH)/crypto/x509v3/v3_addr.c >> + $(OPENSSL_PATH)/crypto/x509v3/v3_admis.c >> $(OPENSSL_PATH)/crypto/x509v3/v3_akey.c >> $(OPENSSL_PATH)/crypto/x509v3/v3_akeya.c >> $(OPENSSL_PATH)/crypto/x509v3/v3_alt.c >> @@ -479,12 +499,14 @@ [Sources] >> $(OPENSSL_PATH)/ssl/d1_msg.c >> $(OPENSSL_PATH)/ssl/d1_srtp.c >> $(OPENSSL_PATH)/ssl/methods.c >> + $(OPENSSL_PATH)/ssl/packet.c >> $(OPENSSL_PATH)/ssl/pqueue.c >> $(OPENSSL_PATH)/ssl/record/dtls1_bitmap.c >> $(OPENSSL_PATH)/ssl/record/rec_layer_d1.c >> $(OPENSSL_PATH)/ssl/record/rec_layer_s3.c >> $(OPENSSL_PATH)/ssl/record/ssl3_buffer.c >> $(OPENSSL_PATH)/ssl/record/ssl3_record.c >> + $(OPENSSL_PATH)/ssl/record/ssl3_record_tls13.c >> $(OPENSSL_PATH)/ssl/s3_cbc.c >> $(OPENSSL_PATH)/ssl/s3_enc.c >> $(OPENSSL_PATH)/ssl/s3_lib.c >> @@ -502,25 +524,45 @@ [Sources] >> $(OPENSSL_PATH)/ssl/ssl_stat.c >> $(OPENSSL_PATH)/ssl/ssl_txt.c >> $(OPENSSL_PATH)/ssl/ssl_utst.c >> + $(OPENSSL_PATH)/ssl/statem/extensions.c >> + $(OPENSSL_PATH)/ssl/statem/extensions_clnt.c >> + $(OPENSSL_PATH)/ssl/statem/extensions_cust.c >> + $(OPENSSL_PATH)/ssl/statem/extensions_srvr.c >> $(OPENSSL_PATH)/ssl/statem/statem.c >> $(OPENSSL_PATH)/ssl/statem/statem_clnt.c >> $(OPENSSL_PATH)/ssl/statem/statem_dtls.c >> $(OPENSSL_PATH)/ssl/statem/statem_lib.c >> $(OPENSSL_PATH)/ssl/statem/statem_srvr.c >> $(OPENSSL_PATH)/ssl/t1_enc.c >> - $(OPENSSL_PATH)/ssl/t1_ext.c >> $(OPENSSL_PATH)/ssl/t1_lib.c >> - $(OPENSSL_PATH)/ssl/t1_reneg.c >> $(OPENSSL_PATH)/ssl/t1_trce.c >> + $(OPENSSL_PATH)/ssl/tls13_enc.c >> $(OPENSSL_PATH)/ssl/tls_srp.c >> # Autogenerated files list ends here >> >> + ossl_store.c >> + rand_pool.c >> + >> +[Sources.Ia32] >> + rand_pool_noise_tsc.c >> + >> +[Sources.X64] >> + rand_pool_noise_tsc.c >> + >> +[Sources.ARM] >> + rand_pool_noise.c >> + >> +[Sources.AARCH64] >> + rand_pool_noise.c >> + >> [Packages] >> MdePkg/MdePkg.dec >> CryptoPkg/CryptoPkg.dec >> >> [LibraryClasses] >> + BaseLib >> DebugLib >> + TimerLib >> >> [LibraryClasses.ARM] >> ArmSoftFloatLib >> diff --git a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf >> b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf >> index fd12d112edb2..49599a42d180 100644 >> --- a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf >> +++ b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf >> @@ -1,7 +1,7 @@ >> ## @file >> # This module provides OpenSSL Library implementation. >> # >> -# Copyright (c) 2010 - 2018, Intel Corporation. All rights >> reserved.<BR> >> +# Copyright (c) 2010 - 2019, Intel Corporation. All rights >> +reserved.<BR> >> # SPDX-License-Identifier: BSD-2-Clause-Patent # ## @@ -15,7 >> +15,7 @@ [Defines] >> VERSION_STRING = 1.0 >> LIBRARY_CLASS = OpensslLib >> DEFINE OPENSSL_PATH = openssl >> - DEFINE OPENSSL_FLAGS = -DL_ENDIAN -DOPENSSL_SMALL_FOOTPRINT -D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECATE -DNO_SYSLOG >> + DEFINE OPENSSL_FLAGS = -DL_ENDIAN -DOPENSSL_SMALL_FOOTPRINT -D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECATE >> >> # >> # VALID_ARCHITECTURES = IA32 X64 ARM AARCH64 >> @@ -32,6 +32,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/aes/aes_misc.c >> $(OPENSSL_PATH)/crypto/aes/aes_ofb.c >> $(OPENSSL_PATH)/crypto/aes/aes_wrap.c >> + $(OPENSSL_PATH)/crypto/aria/aria.c >> $(OPENSSL_PATH)/crypto/asn1/a_bitstr.c >> $(OPENSSL_PATH)/crypto/asn1/a_d2i_fp.c >> $(OPENSSL_PATH)/crypto/asn1/a_digest.c >> @@ -54,6 +55,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/asn1/ameth_lib.c >> $(OPENSSL_PATH)/crypto/asn1/asn1_err.c >> $(OPENSSL_PATH)/crypto/asn1/asn1_gen.c >> + $(OPENSSL_PATH)/crypto/asn1/asn1_item_list.c >> $(OPENSSL_PATH)/crypto/asn1/asn1_lib.c >> $(OPENSSL_PATH)/crypto/asn1/asn1_par.c >> $(OPENSSL_PATH)/crypto/asn1/asn_mime.c >> @@ -172,6 +174,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/conf/conf_ssl.c >> $(OPENSSL_PATH)/crypto/cpt_err.c >> $(OPENSSL_PATH)/crypto/cryptlib.c >> + $(OPENSSL_PATH)/crypto/ctype.c >> $(OPENSSL_PATH)/crypto/cversion.c >> $(OPENSSL_PATH)/crypto/des/cbc_cksm.c >> $(OPENSSL_PATH)/crypto/des/cbc_enc.c >> @@ -189,7 +192,6 @@ [Sources] >> $(OPENSSL_PATH)/crypto/des/pcbc_enc.c >> $(OPENSSL_PATH)/crypto/des/qud_cksm.c >> $(OPENSSL_PATH)/crypto/des/rand_key.c >> - $(OPENSSL_PATH)/crypto/des/rpc_enc.c >> $(OPENSSL_PATH)/crypto/des/set_key.c >> $(OPENSSL_PATH)/crypto/des/str2key.c >> $(OPENSSL_PATH)/crypto/des/xcbc_enc.c >> @@ -206,6 +208,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/dh/dh_pmeth.c >> $(OPENSSL_PATH)/crypto/dh/dh_prn.c >> $(OPENSSL_PATH)/crypto/dh/dh_rfc5114.c >> + $(OPENSSL_PATH)/crypto/dh/dh_rfc7919.c >> $(OPENSSL_PATH)/crypto/dso/dso_dl.c >> $(OPENSSL_PATH)/crypto/dso/dso_dlfcn.c >> $(OPENSSL_PATH)/crypto/dso/dso_err.c >> @@ -228,6 +231,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/evp/e_aes.c >> $(OPENSSL_PATH)/crypto/evp/e_aes_cbc_hmac_sha1.c >> $(OPENSSL_PATH)/crypto/evp/e_aes_cbc_hmac_sha256.c >> + $(OPENSSL_PATH)/crypto/evp/e_aria.c >> $(OPENSSL_PATH)/crypto/evp/e_bf.c >> $(OPENSSL_PATH)/crypto/evp/e_camellia.c >> $(OPENSSL_PATH)/crypto/evp/e_cast.c >> @@ -242,6 +246,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/evp/e_rc4_hmac_md5.c >> $(OPENSSL_PATH)/crypto/evp/e_rc5.c >> $(OPENSSL_PATH)/crypto/evp/e_seed.c >> + $(OPENSSL_PATH)/crypto/evp/e_sm4.c >> $(OPENSSL_PATH)/crypto/evp/e_xcbc_d.c >> $(OPENSSL_PATH)/crypto/evp/encode.c >> $(OPENSSL_PATH)/crypto/evp/evp_cnf.c >> @@ -259,6 +264,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/evp/m_null.c >> $(OPENSSL_PATH)/crypto/evp/m_ripemd.c >> $(OPENSSL_PATH)/crypto/evp/m_sha1.c >> + $(OPENSSL_PATH)/crypto/evp/m_sha3.c >> $(OPENSSL_PATH)/crypto/evp/m_sigver.c >> $(OPENSSL_PATH)/crypto/evp/m_wp.c >> $(OPENSSL_PATH)/crypto/evp/names.c >> @@ -271,10 +277,10 @@ [Sources] >> $(OPENSSL_PATH)/crypto/evp/p_seal.c >> $(OPENSSL_PATH)/crypto/evp/p_sign.c >> $(OPENSSL_PATH)/crypto/evp/p_verify.c >> + $(OPENSSL_PATH)/crypto/evp/pbe_scrypt.c >> $(OPENSSL_PATH)/crypto/evp/pmeth_fn.c >> $(OPENSSL_PATH)/crypto/evp/pmeth_gn.c >> $(OPENSSL_PATH)/crypto/evp/pmeth_lib.c >> - $(OPENSSL_PATH)/crypto/evp/scrypt.c >> $(OPENSSL_PATH)/crypto/ex_data.c >> $(OPENSSL_PATH)/crypto/getenv.c >> $(OPENSSL_PATH)/crypto/hmac/hm_ameth.c >> @@ -283,6 +289,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/init.c >> $(OPENSSL_PATH)/crypto/kdf/hkdf.c >> $(OPENSSL_PATH)/crypto/kdf/kdf_err.c >> + $(OPENSSL_PATH)/crypto/kdf/scrypt.c >> $(OPENSSL_PATH)/crypto/kdf/tls1_prf.c >> $(OPENSSL_PATH)/crypto/lhash/lh_stats.c >> $(OPENSSL_PATH)/crypto/lhash/lhash.c >> @@ -360,14 +367,14 @@ [Sources] >> $(OPENSSL_PATH)/crypto/pkcs7/pk7_mime.c >> $(OPENSSL_PATH)/crypto/pkcs7/pk7_smime.c >> $(OPENSSL_PATH)/crypto/pkcs7/pkcs7err.c >> - $(OPENSSL_PATH)/crypto/rand/md_rand.c >> + $(OPENSSL_PATH)/crypto/rand/drbg_ctr.c >> + $(OPENSSL_PATH)/crypto/rand/drbg_lib.c >> $(OPENSSL_PATH)/crypto/rand/rand_egd.c >> $(OPENSSL_PATH)/crypto/rand/rand_err.c >> $(OPENSSL_PATH)/crypto/rand/rand_lib.c >> $(OPENSSL_PATH)/crypto/rand/rand_unix.c >> $(OPENSSL_PATH)/crypto/rand/rand_vms.c >> $(OPENSSL_PATH)/crypto/rand/rand_win.c >> - $(OPENSSL_PATH)/crypto/rand/randfile.c >> $(OPENSSL_PATH)/crypto/rc4/rc4_enc.c >> $(OPENSSL_PATH)/crypto/rc4/rc4_skey.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_ameth.c >> @@ -379,8 +386,8 @@ [Sources] >> $(OPENSSL_PATH)/crypto/rsa/rsa_gen.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_lib.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_meth.c >> + $(OPENSSL_PATH)/crypto/rsa/rsa_mp.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_none.c >> - $(OPENSSL_PATH)/crypto/rsa/rsa_null.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_oaep.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_ossl.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_pk1.c >> @@ -392,15 +399,27 @@ [Sources] >> $(OPENSSL_PATH)/crypto/rsa/rsa_ssl.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_x931.c >> $(OPENSSL_PATH)/crypto/rsa/rsa_x931g.c >> + $(OPENSSL_PATH)/crypto/sha/keccak1600.c >> $(OPENSSL_PATH)/crypto/sha/sha1_one.c >> $(OPENSSL_PATH)/crypto/sha/sha1dgst.c >> $(OPENSSL_PATH)/crypto/sha/sha256.c >> $(OPENSSL_PATH)/crypto/sha/sha512.c >> + $(OPENSSL_PATH)/crypto/siphash/siphash.c >> + $(OPENSSL_PATH)/crypto/siphash/siphash_ameth.c >> + $(OPENSSL_PATH)/crypto/siphash/siphash_pmeth.c >> + $(OPENSSL_PATH)/crypto/sm3/m_sm3.c >> + $(OPENSSL_PATH)/crypto/sm3/sm3.c >> + $(OPENSSL_PATH)/crypto/sm4/sm4.c >> $(OPENSSL_PATH)/crypto/stack/stack.c >> $(OPENSSL_PATH)/crypto/threads_none.c >> $(OPENSSL_PATH)/crypto/threads_pthread.c >> $(OPENSSL_PATH)/crypto/threads_win.c >> $(OPENSSL_PATH)/crypto/txt_db/txt_db.c >> + $(OPENSSL_PATH)/crypto/ui/ui_err.c >> + $(OPENSSL_PATH)/crypto/ui/ui_lib.c >> + $(OPENSSL_PATH)/crypto/ui/ui_null.c >> + $(OPENSSL_PATH)/crypto/ui/ui_openssl.c >> + $(OPENSSL_PATH)/crypto/ui/ui_util.c >> $(OPENSSL_PATH)/crypto/uid.c >> $(OPENSSL_PATH)/crypto/x509/by_dir.c >> $(OPENSSL_PATH)/crypto/x509/by_file.c >> @@ -445,6 +464,7 @@ [Sources] >> $(OPENSSL_PATH)/crypto/x509v3/pcy_node.c >> $(OPENSSL_PATH)/crypto/x509v3/pcy_tree.c >> $(OPENSSL_PATH)/crypto/x509v3/v3_addr.c >> + $(OPENSSL_PATH)/crypto/x509v3/v3_admis.c >> $(OPENSSL_PATH)/crypto/x509v3/v3_akey.c >> $(OPENSSL_PATH)/crypto/x509v3/v3_akeya.c >> $(OPENSSL_PATH)/crypto/x509v3/v3_alt.c >> @@ -476,12 +496,29 @@ [Sources] >> $(OPENSSL_PATH)/crypto/x509v3/v3err.c >> # Autogenerated files list ends here >> >> + ossl_store.c >> + rand_pool.c >> + >> +[Sources.Ia32] >> + rand_pool_noise_tsc.c >> + >> +[Sources.X64] >> + rand_pool_noise_tsc.c >> + >> +[Sources.ARM] >> + rand_pool_noise.c >> + >> +[Sources.AARCH64] >> + rand_pool_noise.c >> + >> [Packages] >> MdePkg/MdePkg.dec >> CryptoPkg/CryptoPkg.dec >> >> [LibraryClasses] >> + BaseLib >> DebugLib >> + TimerLib >> >> [LibraryClasses.ARM] >> ArmSoftFloatLib >> diff --git a/CryptoPkg/Library/Include/CrtLibSupport.h >> b/CryptoPkg/Library/Include/CrtLibSupport.h >> index b05c5d908ce2..5806f50f7485 100644 >> --- a/CryptoPkg/Library/Include/CrtLibSupport.h >> +++ b/CryptoPkg/Library/Include/CrtLibSupport.h >> @@ -2,7 +2,7 @@ >> Root include file of C runtime library to support building the third-party >> cryptographic library. >> >> -Copyright (c) 2010 - 2017, Intel Corporation. All rights >> reserved.<BR> >> +Copyright (c) 2010 - 2019, Intel Corporation. All rights >> +reserved.<BR> >> SPDX-License-Identifier: BSD-2-Clause-Patent >> >> **/ >> @@ -21,6 +21,17 @@ SPDX-License-Identifier: BSD-2-Clause-Patent >> #define MAX_STRING_SIZE 0x1000 >> >> // >> +// We already have "no-ui" in out Configure invocation. >> +// but the code still fails to compile. >> +// Ref: https://github.com/openssl/openssl/issues/8904 >> +// >> +// This is defined in CRT library(stdio.h). >> +// >> +#ifndef BUFSIZ >> +#define BUFSIZ 8192 >> +#endif >> + >> +// >> // OpenSSL relies on explicit configuration for word size in >> crypto/bn, // but we want it to be automatically inferred from the >> target. So we // bypass what's in <openssl/opensslconf.h> for >> OPENSSL_SYS_UEFI, and diff --git >> a/CryptoPkg/Library/Include/openssl/opensslconf.h >> b/CryptoPkg/Library/Include/openssl/opensslconf.h >> index 28dd9ab93c61..07fa2d3ce280 100644 >> --- a/CryptoPkg/Library/Include/openssl/opensslconf.h >> +++ b/CryptoPkg/Library/Include/openssl/opensslconf.h >> @@ -10,6 +10,8 @@ >> * https://www.openssl.org/source/license.html >> */ >> >> +#include <openssl/opensslv.h> >> + >> #ifdef __cplusplus >> extern "C" { >> #endif >> @@ -77,18 +79,21 @@ extern "C" { >> #ifndef OPENSSL_NO_SEED >> # define OPENSSL_NO_SEED >> #endif >> +#ifndef OPENSSL_NO_SM2 >> +# define OPENSSL_NO_SM2 >> +#endif >> #ifndef OPENSSL_NO_SRP >> # define OPENSSL_NO_SRP >> #endif >> #ifndef OPENSSL_NO_TS >> # define OPENSSL_NO_TS >> #endif >> -#ifndef OPENSSL_NO_UI >> -# define OPENSSL_NO_UI >> -#endif >> #ifndef OPENSSL_NO_WHIRLPOOL >> # define OPENSSL_NO_WHIRLPOOL >> #endif >> +#ifndef OPENSSL_RAND_SEED_NONE >> +# define OPENSSL_RAND_SEED_NONE >> +#endif >> #ifndef OPENSSL_NO_AFALGENG >> # define OPENSSL_NO_AFALGENG >> #endif >> @@ -122,6 +127,9 @@ extern "C" { >> #ifndef OPENSSL_NO_DEPRECATED >> # define OPENSSL_NO_DEPRECATED >> #endif >> +#ifndef OPENSSL_NO_DEVCRYPTOENG >> +# define OPENSSL_NO_DEVCRYPTOENG >> +#endif >> #ifndef OPENSSL_NO_DGRAM >> # define OPENSSL_NO_DGRAM >> #endif >> @@ -155,6 +163,9 @@ extern "C" { >> #ifndef OPENSSL_NO_ERR >> # define OPENSSL_NO_ERR >> #endif >> +#ifndef OPENSSL_NO_EXTERNAL_TESTS >> +# define OPENSSL_NO_EXTERNAL_TESTS >> +#endif >> #ifndef OPENSSL_NO_FILENAMES >> # define OPENSSL_NO_FILENAMES >> #endif >> @@ -209,15 +220,24 @@ extern "C" { >> #ifndef OPENSSL_NO_TESTS >> # define OPENSSL_NO_TESTS >> #endif >> +#ifndef OPENSSL_NO_TLS1_3 >> +# define OPENSSL_NO_TLS1_3 >> +#endif >> #ifndef OPENSSL_NO_UBSAN >> # define OPENSSL_NO_UBSAN >> #endif >> +#ifndef OPENSSL_NO_UI_CONSOLE >> +# define OPENSSL_NO_UI_CONSOLE >> +#endif >> #ifndef OPENSSL_NO_UNIT_TEST >> # define OPENSSL_NO_UNIT_TEST >> #endif >> #ifndef OPENSSL_NO_WEAK_SSL_CIPHERS >> # define OPENSSL_NO_WEAK_SSL_CIPHERS #endif >> +#ifndef OPENSSL_NO_DYNAMIC_ENGINE >> +# define OPENSSL_NO_DYNAMIC_ENGINE >> +#endif >> #ifndef OPENSSL_NO_AFALGENG >> # define OPENSSL_NO_AFALGENG >> #endif >> @@ -236,15 +256,11 @@ extern "C" { >> * functions. >> */ >> #ifndef DECLARE_DEPRECATED >> -# if defined(OPENSSL_NO_DEPRECATED) >> -# define DECLARE_DEPRECATED(f) >> -# else >> -# define DECLARE_DEPRECATED(f) f; >> -# ifdef __GNUC__ >> -# if __GNUC__ > 3 || (__GNUC__ == 3 && __GNUC_MINOR__ > 0) >> -# undef DECLARE_DEPRECATED >> -# define DECLARE_DEPRECATED(f) f __attribute__ ((deprecated)); >> -# endif >> +# define DECLARE_DEPRECATED(f) f; >> +# ifdef __GNUC__ >> +# if __GNUC__ > 3 || (__GNUC__ == 3 && __GNUC_MINOR__ > 0) >> +# undef DECLARE_DEPRECATED >> +# define DECLARE_DEPRECATED(f) f __attribute__ ((deprecated)); >> # endif >> # endif >> #endif >> @@ -268,6 +284,18 @@ extern "C" { >> # define OPENSSL_API_COMPAT OPENSSL_MIN_API #endif >> >> +/* >> + * Do not deprecate things to be deprecated in version 1.2.0 before >> +the >> + * OpenSSL version number matches. >> + */ >> +#if OPENSSL_VERSION_NUMBER < 0x10200000L >> +# define DEPRECATEDIN_1_2_0(f) f; >> +#elif OPENSSL_API_COMPAT < 0x10200000L >> +# define DEPRECATEDIN_1_2_0(f) DECLARE_DEPRECATED(f) >> +#else >> +# define DEPRECATEDIN_1_2_0(f) >> +#endif >> + >> #if OPENSSL_API_COMPAT < 0x10100000L >> # define DEPRECATEDIN_1_1_0(f) DECLARE_DEPRECATED(f) >> #else >> @@ -286,8 +314,6 @@ extern "C" { >> # define DEPRECATEDIN_0_9_8(f) >> #endif >> >> - >> - >> /* Generate 80386 code? */ >> #undef I386_ONLY >> >> diff --git a/CryptoPkg/Library/OpensslLib/buildinf.h >> b/CryptoPkg/Library/OpensslLib/buildinf.h >> index c5ca293c729f..b840c8656a28 100644 >> --- a/CryptoPkg/Library/OpensslLib/buildinf.h >> +++ b/CryptoPkg/Library/OpensslLib/buildinf.h >> @@ -1,2 +1,4 @@ >> #define PLATFORM "UEFI" >> #define DATE "Fri Dec 22 01:23:45 PDT 2017" >> + >> +const char * compiler_flags = "compiler: information not available >> +from edk2"; >> diff --git a/CryptoPkg/Library/OpensslLib/rand_pool_noise.h >> b/CryptoPkg/Library/OpensslLib/rand_pool_noise.h >> new file mode 100644 >> index 000000000000..75acc686a9f1 >> --- /dev/null >> +++ b/CryptoPkg/Library/OpensslLib/rand_pool_noise.h >> @@ -0,0 +1,29 @@ >> +/** @file >> + Provide rand noise source. >> + >> +Copyright (c) 2019, Intel Corporation. All rights reserved.<BR> >> +SPDX-License-Identifier: BSD-2-Clause-Patent >> + >> +**/ >> + >> +#ifndef __RAND_POOL_NOISE_H__ >> +#define __RAND_POOL_NOISE_H__ >> + >> +#include <Uefi/UefiBaseType.h> >> + >> +/** >> + Get 64-bit noise source. >> + >> + @param[out] Rand Buffer pointer to store 64-bit noise source >> + >> + @retval TRUE Get randomness successfully. >> + @retval FALSE Failed to generate >> +**/ >> +BOOLEAN >> +EFIAPI >> +GetRandomNoise64 ( >> + OUT UINT64 *Rand >> + ); >> + >> + >> +#endif // __RAND_POOL_NOISE_H__ >> diff --git a/CryptoPkg/Library/OpensslLib/ossl_store.c >> b/CryptoPkg/Library/OpensslLib/ossl_store.c >> new file mode 100644 >> index 000000000000..29e1506048e3 >> --- /dev/null >> +++ b/CryptoPkg/Library/OpensslLib/ossl_store.c >> @@ -0,0 +1,17 @@ >> +/** @file >> + Dummy implement ossl_store(Store retrieval functions) for UEFI. >> + >> +Copyright (c) 2019, Intel Corporation. All rights reserved.<BR> >> +SPDX-License-Identifier: BSD-2-Clause-Patent >> + >> +**/ >> + >> +/* >> + * This function is cleanup ossl store. >> + * >> + * Dummy Implement for UEFI >> + */ >> +void ossl_store_cleanup_int(void) >> +{ >> +} >> + >> diff --git a/CryptoPkg/Library/OpensslLib/rand_pool.c >> b/CryptoPkg/Library/OpensslLib/rand_pool.c >> new file mode 100644 >> index 000000000000..9d2a4ad13823 >> --- /dev/null >> +++ b/CryptoPkg/Library/OpensslLib/rand_pool.c >> @@ -0,0 +1,316 @@ >> +/** @file >> + OpenSSL_1_1_1b doesn't implement rand_pool_* functions for UEFI. >> + The file implement these functions. >> + >> +Copyright (c) 2019, Intel Corporation. All rights reserved.<BR> >> +SPDX-License-Identifier: BSD-2-Clause-Patent >> + >> +**/ >> + >> +#include "internal/rand_int.h" >> +#include <openssl/aes.h> >> + >> +#include <Uefi.h> >> +#include <Library/TimerLib.h> >> + >> +#include "rand_pool_noise.h" >> + >> +/** >> + Get some randomness from low-order bits of GetPerformanceCounter results. >> + And combine them to the 64-bit value >> + >> + @param[out] Rand Buffer pointer to store the 64-bit random value. >> + >> + @retval TRUE Random number generated successfully. >> + @retval FALSE Failed to generate. >> +**/ >> +STATIC >> +BOOLEAN >> +EFIAPI >> +GetRandNoise64FromPerformanceCounter( >> + OUT UINT64 *Rand >> + ) >> +{ >> + UINT32 Index; >> + UINT32 *RandPtr; >> + >> + if (NULL == Rand) { >> + return FALSE; >> + } >> + >> + RandPtr = (UINT32 *) Rand; >> + >> + for (Index = 0; Index < 2; Index ++) { >> + *RandPtr = (UINT32) (GetPerformanceCounter () & 0xFF); >> + MicroSecondDelay (10); >> + RandPtr++; >> + } >> + >> + return TRUE; >> +} >> + >> +/** >> + Calls RandomNumber64 to fill >> + a buffer of arbitrary size with random bytes. >> + >> + @param[in] Length Size of the buffer, in bytes, to fill with. >> + @param[out] RandBuffer Pointer to the buffer to store the random result. >> + >> + @retval EFI_SUCCESS Random bytes generation succeeded. >> + @retval EFI_NOT_READY Failed to request random bytes. >> + >> +**/ >> +STATIC >> +BOOLEAN >> +EFIAPI >> +RandGetBytes ( >> + IN UINTN Length, >> + OUT UINT8 *RandBuffer >> + ) >> +{ >> + BOOLEAN Ret; >> + UINT64 TempRand; >> + >> + Ret = FALSE; >> + >> + while (Length > 0) { >> + // >> + // Get random noise from platform. >> + // If it failed, fallback to PerformanceCounter >> + // If you really care about security, you must override >> + // GetRandomNoise64FromPlatform. >> + // >> + Ret = GetRandomNoise64 (&TempRand); >> + if (Ret == FALSE) { >> + Ret = GetRandNoise64FromPerformanceCounter (&TempRand); >> + } >> + if (!Ret) { >> + return Ret; >> + } >> + if (Length >= sizeof (TempRand)) { >> + *((UINT64*) RandBuffer) = TempRand; >> + RandBuffer += sizeof (UINT64); >> + Length -= sizeof (TempRand); >> + } else { >> + CopyMem (RandBuffer, &TempRand, Length); >> + Length = 0; >> + } >> + } >> + >> + return Ret; >> +} >> + >> +/** >> + Creates a 128bit random value that is fully forward and backward >> +prediction resistant, >> + suitable for seeding a NIST SP800-90 Compliant. >> + This function takes multiple random numbers from >> +PerformanceCounter to ensure reseeding >> + and performs AES-CBC-MAC over the data to compute the seed value. >> + >> + @param[out] SeedBuffer Pointer to a 128bit buffer to store the random seed. >> + >> + @retval TRUE Random seed generation succeeded. >> + @retval FALSE Failed to request random bytes. >> + >> +**/ >> +STATIC >> +BOOLEAN >> +EFIAPI >> +RandGetSeed128 ( >> + OUT UINT8 *SeedBuffer >> + ) >> +{ >> + BOOLEAN Ret; >> + UINT8 RandByte[16]; >> + UINT8 Key[16]; >> + UINT8 Ffv[16]; >> + UINT8 Xored[16]; >> + UINT32 Index; >> + UINT32 Index2; >> + AES_KEY AESKey; >> + >> + // >> + // Chose an arbitary key and zero the feed_forward_value (FFV) // >> + for (Index = 0; Index < 16; Index++) { >> + Key[Index] = (UINT8) Index; >> + Ffv[Index] = 0; >> + } >> + >> + AES_set_encrypt_key (Key, 16 * 8, &AESKey); >> + >> + // >> + // Perform CBC_MAC over 32 * 128 bit values, with 10us gaps >> + between >> + 128 bit value // The 10us gaps will ensure multiple reseeds within >> + the system time with a large // design margin. >> + // >> + for (Index = 0; Index < 32; Index++) { >> + MicroSecondDelay (10); >> + Ret = RandGetBytes (16, RandByte); >> + if (!Ret) { >> + return Ret; >> + } >> + >> + // >> + // Perform XOR operations on two 128-bit value. >> + // >> + for (Index2 = 0; Index2 < 16; Index2++) { >> + Xored[Index2] = RandByte[Index2] ^ Ffv[Index2]; >> + } >> + >> + AES_encrypt (Xored, Ffv, &AESKey); } >> + >> + for (Index = 0; Index < 16; Index++) { >> + SeedBuffer[Index] = Ffv[Index]; >> + } >> + >> + return Ret; >> +} >> + >> +/** >> + Generate high-quality entropy source. >> + >> + @param[in] Length Size of the buffer, in bytes, to fill with. >> + @param[out] Entropy Pointer to the buffer to store the entropy data. >> + >> + @retval EFI_SUCCESS Entropy generation succeeded. >> + @retval EFI_NOT_READY Failed to request random data. >> + >> +**/ >> +STATIC >> +BOOLEAN >> +EFIAPI >> +RandGenerateEntropy ( >> + IN UINTN Length, >> + OUT UINT8 *Entropy >> + ) >> +{ >> + BOOLEAN Ret; >> + UINTN BlockCount; >> + UINT8 Seed[16]; >> + UINT8 *Ptr; >> + >> + BlockCount = Length / 16; >> + Ptr = (UINT8 *) Entropy; >> + >> + // >> + // Generate high-quality seed for DRBG Entropy // while >> + (BlockCount > 0) { >> + Ret = RandGetSeed128 (Seed); >> + if (!Ret) { >> + return Ret; >> + } >> + CopyMem (Ptr, Seed, 16); >> + >> + BlockCount--; >> + Ptr = Ptr + 16; >> + } >> + >> + // >> + // Populate the remained data as request. >> + // >> + Ret = RandGetSeed128 (Seed); >> + if (!Ret) { >> + return Ret; >> + } >> + CopyMem (Ptr, Seed, (Length % 16)); >> + >> + return Ret; >> +} >> + >> +/* >> + * Add random bytes to the pool to acquire requested amount of >> +entropy >> + * >> + * This function is platform specific and tries to acquire the >> +requested >> + * amount of entropy by polling platform specific entropy sources. >> + * >> + * This is OpenSSL required interface. >> + */ >> +size_t rand_pool_acquire_entropy(RAND_POOL *pool) { >> + BOOLEAN Ret; >> + size_t bytes_needed; >> + unsigned char * buffer; >> + >> + bytes_needed = rand_pool_bytes_needed(pool, 1 /*entropy_factor*/); >> + if (bytes_needed > 0) { >> + buffer = rand_pool_add_begin(pool, bytes_needed); >> + >> + if (buffer != NULL) { >> + Ret = RandGenerateEntropy(bytes_needed, buffer); >> + if (FALSE == Ret) { >> + rand_pool_add_end(pool, 0, 0); >> + } else { >> + rand_pool_add_end(pool, bytes_needed, 8 * bytes_needed); >> + } >> + } >> + } >> + >> + return rand_pool_entropy_available(pool); >> +} >> + >> +/* >> + * Implementation for UEFI >> + * >> + * This is OpenSSL required interface. >> + */ >> +int rand_pool_add_nonce_data(RAND_POOL *pool) { >> + struct { >> + UINT64 Rand; >> + UINT64 TimerValue; >> + } data = { 0 }; >> + >> + RandGetBytes(8, (UINT8 *)&(data.Rand)); data.TimerValue = >> + GetPerformanceCounter(); >> + >> + return rand_pool_add(pool, (unsigned char*)&data, sizeof(data), >> +0); } >> + >> +/* >> + * Implementation for UEFI >> + * >> + * This is OpenSSL required interface. >> + */ >> +int rand_pool_add_additional_data(RAND_POOL *pool) { >> + struct { >> + UINT64 Rand; >> + UINT64 TimerValue; >> + } data = { 0 }; >> + >> + RandGetBytes(8, (UINT8 *)&(data.Rand)); data.TimerValue = >> + GetPerformanceCounter(); >> + >> + return rand_pool_add(pool, (unsigned char*)&data, sizeof(data), >> +0); } >> + >> +/* >> + * Dummy Implememtation for UEFI >> + * >> + * This is OpenSSL required interface. >> + */ >> +int rand_pool_init(void) >> +{ >> + return 1; >> +} >> + >> +/* >> + * Dummy Implememtation for UEFI >> + * >> + * This is OpenSSL required interface. >> + */ >> +void rand_pool_cleanup(void) >> +{ >> +} >> + >> +/* >> + * Dummy Implememtation for UEFI >> + * >> + * This is OpenSSL required interface. >> + */ >> +void rand_pool_keep_random_devices_open(int keep) { } >> + >> diff --git a/CryptoPkg/Library/OpensslLib/rand_pool_noise.c >> b/CryptoPkg/Library/OpensslLib/rand_pool_noise.c >> new file mode 100644 >> index 000000000000..c16ed8b45496 >> --- /dev/null >> +++ b/CryptoPkg/Library/OpensslLib/rand_pool_noise.c >> @@ -0,0 +1,29 @@ >> +/** @file >> + Provide rand noise source. >> + >> +Copyright (c) 2019, Intel Corporation. All rights reserved.<BR> >> +SPDX-License-Identifier: BSD-2-Clause-Patent >> + >> +**/ >> + >> +#include <Library/BaseLib.h> >> + >> +/** >> + Get 64-bit noise source >> + >> + @param[out] Rand Buffer pointer to store 64-bit noise source >> + >> + @retval FALSE Failed to generate >> +**/ >> +BOOLEAN >> +EFIAPI >> +GetRandomNoise64 ( >> + OUT UINT64 *Rand >> + ) >> +{ >> + // >> + // Return FALSE will fallback to use PerformaceCounter to >> + // generate noise. >> + // >> + return FALSE; >> +} >> diff --git a/CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c >> b/CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c >> new file mode 100644 >> index 000000000000..4158106231fd >> --- /dev/null >> +++ b/CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c >> @@ -0,0 +1,43 @@ >> +/** @file >> + Provide rand noise source. >> + >> +Copyright (c) 2019, Intel Corporation. All rights reserved.<BR> >> +SPDX-License-Identifier: BSD-2-Clause-Patent >> + >> +**/ >> + >> +#include <Library/BaseLib.h> >> +#include <Library/DebugLib.h> >> +#include <Library/TimerLib.h> >> + >> +/** >> + Get 64-bit noise source >> + >> + @param[out] Rand Buffer pointer to store 64-bit noise source >> + >> + @retval TRUE Get randomness successfully. >> + @retval FALSE Failed to generate >> +**/ >> +BOOLEAN >> +EFIAPI >> +GetRandomNoise64 ( >> + OUT UINT64 *Rand >> + ) >> +{ >> + UINT32 Index; >> + UINT32 *RandPtr; >> + >> + if (NULL == Rand) { >> + return FALSE; >> + } >> + >> + RandPtr = (UINT32 *)Rand; >> + >> + for (Index = 0; Index < 2; Index ++) { >> + *RandPtr = (UINT32) ((AsmReadTsc ()) & 0xFF); >> + RandPtr++; >> + MicroSecondDelay (10); >> + } >> + >> + return TRUE; >> +} >> diff --git a/CryptoPkg/Library/OpensslLib/openssl >> b/CryptoPkg/Library/OpensslLib/openssl >> index 74f2d9c1ec5f..50eaac9f3337 160000 >> --- a/CryptoPkg/Library/OpensslLib/openssl >> +++ b/CryptoPkg/Library/OpensslLib/openssl >> @@ -1 +1 @@ >> -Subproject commit 74f2d9c1ec5f5510e1d3da5a9f03c28df0977762 >> +Subproject commit 50eaac9f3337667259de725451f201e784599687 >> > ^ permalink raw reply [flat|nested] 39+ messages in thread
* [PATCH v4 7/7] CryptoPkg/BaseCryptLib: Make HMAC_CTX size backward compatible 2019-05-16 7:54 [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b Xiaoyu lu ` (5 preceding siblings ...) 2019-05-16 7:54 ` [PATCH v4 6/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b Xiaoyu lu @ 2019-05-16 7:54 ` Xiaoyu lu 2019-05-16 18:25 ` [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b Laszlo Ersek ` (3 subsequent siblings) 10 siblings, 0 replies; 39+ messages in thread From: Xiaoyu lu @ 2019-05-16 7:54 UTC (permalink / raw) To: devel; +Cc: Laszlo Ersek, Jian J Wang, Ting Ye Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1089 OpenSSL internally redefines the size of HMAC_CTX at crypto/hmac/hmac_lcl.h(OpenSSL commit e0810e35). Ref: https://github.com/openssl/openssl/pull/4338 We should not use it directly and should remove relevant functions(Hmac*GetContextSize). Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1792 But for compatiblility, temporarily change these definition of HMAC_*_CTX_SIZE. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Ting Ye <ting.ye@intel.com> Signed-off-by: Xiaoyu Lu <xiaoyux.lu@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> --- CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacMd5.c | 8 ++++++-- CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha1.c | 9 +++++++-- CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha256.c | 8 ++++++-- 3 files changed, 19 insertions(+), 6 deletions(-) diff --git a/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacMd5.c b/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacMd5.c index 3134806797f8..19e9fbeae66f 100644 --- a/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacMd5.c +++ b/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacMd5.c @@ -9,8 +9,12 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #include "InternalCryptLib.h" #include <openssl/hmac.h> -#define HMAC_MD5_CTX_SIZE sizeof(void *) * 4 + sizeof(unsigned int) + \ - sizeof(unsigned char) * HMAC_MAX_MD_CBLOCK +// +// NOTE: OpenSSL redefines the size of HMAC_CTX at crypto/hmac/hmac_lcl.h +// #define HMAC_MAX_MD_CBLOCK_SIZE 144 +// +#define HMAC_MD5_CTX_SIZE (sizeof(void *) * 4 + sizeof(unsigned int) + \ + sizeof(unsigned char) * 144) /** Retrieves the size, in bytes, of the context buffer required for HMAC-MD5 operations. diff --git a/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha1.c b/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha1.c index bbe3df4d4f70..7d7df9640e7f 100644 --- a/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha1.c +++ b/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha1.c @@ -9,8 +9,13 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #include "InternalCryptLib.h" #include <openssl/hmac.h> -#define HMAC_SHA1_CTX_SIZE sizeof(void *) * 4 + sizeof(unsigned int) + \ - sizeof(unsigned char) * HMAC_MAX_MD_CBLOCK +// +// NOTE: OpenSSL redefines the size of HMAC_CTX at crypto/hmac/hmac_lcl.h +// #define HMAC_MAX_MD_CBLOCK_SIZE 144 +// +// +#define HMAC_SHA1_CTX_SIZE (sizeof(void *) * 4 + sizeof(unsigned int) + \ + sizeof(unsigned char) * 144) /** Retrieves the size, in bytes, of the context buffer required for HMAC-SHA1 operations. diff --git a/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha256.c b/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha256.c index ac9084fa850d..f24443e74552 100644 --- a/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha256.c +++ b/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha256.c @@ -9,8 +9,12 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #include "InternalCryptLib.h" #include <openssl/hmac.h> -#define HMAC_SHA256_CTX_SIZE sizeof(void *) * 4 + sizeof(unsigned int) + \ - sizeof(unsigned char) * HMAC_MAX_MD_CBLOCK +// +// NOTE: OpenSSL redefines the size of HMAC_CTX at crypto/hmac/hmac_lcl.h +// #define HMAC_MAX_MD_CBLOCK_SIZE 144 +// +#define HMAC_SHA256_CTX_SIZE (sizeof(void *) * 4 + sizeof(unsigned int) + \ + sizeof(unsigned char) * 144) /** Retrieves the size, in bytes, of the context buffer required for HMAC-SHA256 operations. -- 2.7.4 ^ permalink raw reply related [flat|nested] 39+ messages in thread
* Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b 2019-05-16 7:54 [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b Xiaoyu lu ` (6 preceding siblings ...) 2019-05-16 7:54 ` [PATCH v4 7/7] CryptoPkg/BaseCryptLib: Make HMAC_CTX size backward compatible Xiaoyu lu @ 2019-05-16 18:25 ` Laszlo Ersek 2019-05-17 5:11 ` Wang, Jian J 2019-05-17 10:12 ` Xiaoyu Lu 2019-05-16 18:53 ` Laszlo Ersek ` (2 subsequent siblings) 10 siblings, 2 replies; 39+ messages in thread From: Laszlo Ersek @ 2019-05-16 18:25 UTC (permalink / raw) To: devel, xiaoyux.lu; +Cc: Jian J Wang, Ting Ye, Ard Biesheuvel, Leif Lindholm Hi, (+ Ard and Leif) On 05/16/19 09:54, Xiaoyu lu wrote: > This series is also available at: > https://github.com/xiaoyuxlu/edk2/tree/bz_1089_upgrade_to_openssl_1_1_1b_v4 > > Changes: > > (1) CryptoPkgOpensslLib: Modify process_files.pl for upgrading OpenSSL > > (2) CryptoPkg/OpensslLib: Exclude unnecessary files in process_files.pl > crypto/store/* are excluded. > crypto/rand/randfile.c is excluded. > > (3) CryptoPkg/IntrinsicLib: Fix possible unresolved external symbol issue > > (4) CryptoPkg/OpensslLib: Prepare for upgrading OpenSSL > Disable warnings for buiding OpenSSL_1_1_1b > > (5) CryptoPkg/OpensslLib: Fix cross-build problem for AARCH64 > > (6) CryptoPkg: Upgrade OpenSSL to 1.1.1b > The biggest change is use TSC as entropy source > If TSC isn't avaiable, fallback to TimerLib(PerformanceCounter). > > (7) CryptoPkg/BaseCryptLib: Make HMAC_CTX size backward compatible > > > Verification done for this series: > * Https boot in OvmfPkg. > * BaseCrypt Library test. (Ovmf, EmulatorPkg) > > Important notice: > Nt32Pkg doesn't support TimerLib >> TimerLib|MdePkg/Library/BaseTimerLibNullTemplate/BaseTimerLibNullTemplate.inf > So it will failed in Nt32Pkg. > > Cc: Jian J Wang <jian.j.wang@intel.com> > Cc: Ting Ye <ting.ye@intel.com> > > Laszlo Ersek (1): > CryptoPkg/OpensslLib: Fix cross-build problem for AARCH64 > > Xiaoyu Lu (6): > CryptoPkg/OpensslLib: Modify process_files.pl for upgrading OpenSSL > CryptoPkg/OpensslLib: Exclude unnecessary files in process_files.pl > CryptoPkg/IntrinsicLib: Fix possible unresolved external symbol issue > CryptoPkg/OpensslLib: Prepare for upgrading OpenSSL > CryptoPkg: Upgrade OpenSSL to 1.1.1b > CryptoPkg/BaseCryptLib: Make HMAC_CTX size backward compatible > > CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf | 4 +- > CryptoPkg/Library/OpensslLib/OpensslLib.inf | 76 ++++- > CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 67 ++++- > CryptoPkg/Library/Include/CrtLibSupport.h | 13 +- > CryptoPkg/Library/Include/openssl/opensslconf.h | 54 +++- > CryptoPkg/Library/Include/sys/syscall.h | 11 + > CryptoPkg/Library/OpensslLib/buildinf.h | 2 + > CryptoPkg/Library/OpensslLib/rand_pool_noise.h | 29 ++ > CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacMd5.c | 8 +- > .../Library/BaseCryptLib/Hmac/CryptHmacSha1.c | 9 +- > .../Library/BaseCryptLib/Hmac/CryptHmacSha256.c | 8 +- > CryptoPkg/Library/IntrinsicLib/Ia32/MathFtol.c | 22 ++ > CryptoPkg/Library/OpensslLib/ossl_store.c | 17 ++ > CryptoPkg/Library/OpensslLib/rand_pool.c | 316 +++++++++++++++++++++ > CryptoPkg/Library/OpensslLib/rand_pool_noise.c | 29 ++ > CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c | 43 +++ > CryptoPkg/Library/OpensslLib/openssl | 2 +- > CryptoPkg/Library/OpensslLib/process_files.pl | 11 +- > 18 files changed, 669 insertions(+), 52 deletions(-) > create mode 100644 CryptoPkg/Library/Include/sys/syscall.h > create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.h > create mode 100644 CryptoPkg/Library/IntrinsicLib/Ia32/MathFtol.c > create mode 100644 CryptoPkg/Library/OpensslLib/ossl_store.c > create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool.c > create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.c > create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c > Unfortunately, I've found another build issue with this series. (My apologies that I didn't discover it earlier.) It is reported in the 32-bit (ARM) build of the ArmVirtQemu platform: CryptoPkg/Library/OpensslLib/openssl/crypto/rand/drbg_lib.c:1028: undefined reference to `__aeabi_ui2d' The referenced line is from the drbg_add() function: if (buflen < seedlen || randomness < (double) seedlen) { Beyond the failure to resolve the "__aeabi_ui2d" symbol, the edk2 coding style spec says, "Floating point operations are not recommended in UEFI firmware." (Even though the UEFI spec describes the required floating point environment for all architectures.) So, I'm not sure what we should do here. If we think that floating point is plain evil in edk2, then we cannot rebase edk2 to OpenSSL-1.1.1b. ... Hmmm, this seems to be the 32-bit ARM variant of [PATCH v4 3/7]! If we find floating point generally acceptable in edk2, then Ard and Leif could help us decide please whether this 32-bit ARM issue should be fixed during the feature freeze (when fixes are still allowed), or if it justifies postponing OpenSSL 1.1.1b to the next edk2 stable tag. Again, I'm sorry that I found this only now -- but "CryptoPkg/CryptoPkg.dsc" is multi-arch: SUPPORTED_ARCHITECTURES = IA32|X64|ARM|AARCH64 thus, preferably, a CryptoPkg patch series should be at least build tested (if not boot tested) for all arches, before being posted to the mailing list. (Yes, CI would help a lot with such issues.) Thanks Laszlo ^ permalink raw reply [flat|nested] 39+ messages in thread
* Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b 2019-05-16 18:25 ` [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b Laszlo Ersek @ 2019-05-17 5:11 ` Wang, Jian J 2019-05-17 13:04 ` Laszlo Ersek 2019-05-17 10:12 ` Xiaoyu Lu 1 sibling, 1 reply; 39+ messages in thread From: Wang, Jian J @ 2019-05-17 5:11 UTC (permalink / raw) To: Laszlo Ersek, devel@edk2.groups.io, Lu, XiaoyuX Cc: Ye, Ting, Ard Biesheuvel, Leif Lindholm, Gao, Liming Hi Laszlo, There's already a float library used in OpensslLib.inf. [LibraryClasses.ARM] ArmSoftFloatLib The problem is that the below instance doesn't implement __aeabi_ui2d and __aeabi_d2uiz (I encountered this one as well) ArmPkg\Library\ArmSoftFloatLib\ArmSoftFloatLib.inf I think we can update this library support those two APIs. So what about we still push the patch and file a BZ to fix this issue? Regards, Jian > -----Original Message----- > From: Laszlo Ersek [mailto:lersek@redhat.com] > Sent: Friday, May 17, 2019 2:26 AM > To: devel@edk2.groups.io; Lu, XiaoyuX <xiaoyux.lu@intel.com> > Cc: Wang, Jian J <jian.j.wang@intel.com>; Ye, Ting <ting.ye@intel.com>; Ard > Biesheuvel <ard.biesheuvel@linaro.org>; Leif Lindholm > <leif.lindholm@linaro.org> > Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b > > Hi, > > (+ Ard and Leif) > > On 05/16/19 09:54, Xiaoyu lu wrote: > > This series is also available at: > > > https://github.com/xiaoyuxlu/edk2/tree/bz_1089_upgrade_to_openssl_1_1_1b > _v4 > > > > Changes: > > > > (1) CryptoPkgOpensslLib: Modify process_files.pl for upgrading OpenSSL > > > > (2) CryptoPkg/OpensslLib: Exclude unnecessary files in process_files.pl > > crypto/store/* are excluded. > > crypto/rand/randfile.c is excluded. > > > > (3) CryptoPkg/IntrinsicLib: Fix possible unresolved external symbol issue > > > > (4) CryptoPkg/OpensslLib: Prepare for upgrading OpenSSL > > Disable warnings for buiding OpenSSL_1_1_1b > > > > (5) CryptoPkg/OpensslLib: Fix cross-build problem for AARCH64 > > > > (6) CryptoPkg: Upgrade OpenSSL to 1.1.1b > > The biggest change is use TSC as entropy source > > If TSC isn't avaiable, fallback to TimerLib(PerformanceCounter). > > > > (7) CryptoPkg/BaseCryptLib: Make HMAC_CTX size backward compatible > > > > > > Verification done for this series: > > * Https boot in OvmfPkg. > > * BaseCrypt Library test. (Ovmf, EmulatorPkg) > > > > Important notice: > > Nt32Pkg doesn't support TimerLib > >> > TimerLib|MdePkg/Library/BaseTimerLibNullTemplate/BaseTimerLibNullTemplat > e.inf > > So it will failed in Nt32Pkg. > > > > Cc: Jian J Wang <jian.j.wang@intel.com> > > Cc: Ting Ye <ting.ye@intel.com> > > > > Laszlo Ersek (1): > > CryptoPkg/OpensslLib: Fix cross-build problem for AARCH64 > > > > Xiaoyu Lu (6): > > CryptoPkg/OpensslLib: Modify process_files.pl for upgrading OpenSSL > > CryptoPkg/OpensslLib: Exclude unnecessary files in process_files.pl > > CryptoPkg/IntrinsicLib: Fix possible unresolved external symbol issue > > CryptoPkg/OpensslLib: Prepare for upgrading OpenSSL > > CryptoPkg: Upgrade OpenSSL to 1.1.1b > > CryptoPkg/BaseCryptLib: Make HMAC_CTX size backward compatible > > > > CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf | 4 +- > > CryptoPkg/Library/OpensslLib/OpensslLib.inf | 76 ++++- > > CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 67 ++++- > > CryptoPkg/Library/Include/CrtLibSupport.h | 13 +- > > CryptoPkg/Library/Include/openssl/opensslconf.h | 54 +++- > > CryptoPkg/Library/Include/sys/syscall.h | 11 + > > CryptoPkg/Library/OpensslLib/buildinf.h | 2 + > > CryptoPkg/Library/OpensslLib/rand_pool_noise.h | 29 ++ > > CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacMd5.c | 8 +- > > .../Library/BaseCryptLib/Hmac/CryptHmacSha1.c | 9 +- > > .../Library/BaseCryptLib/Hmac/CryptHmacSha256.c | 8 +- > > CryptoPkg/Library/IntrinsicLib/Ia32/MathFtol.c | 22 ++ > > CryptoPkg/Library/OpensslLib/ossl_store.c | 17 ++ > > CryptoPkg/Library/OpensslLib/rand_pool.c | 316 > +++++++++++++++++++++ > > CryptoPkg/Library/OpensslLib/rand_pool_noise.c | 29 ++ > > CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c | 43 +++ > > CryptoPkg/Library/OpensslLib/openssl | 2 +- > > CryptoPkg/Library/OpensslLib/process_files.pl | 11 +- > > 18 files changed, 669 insertions(+), 52 deletions(-) > > create mode 100644 CryptoPkg/Library/Include/sys/syscall.h > > create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.h > > create mode 100644 CryptoPkg/Library/IntrinsicLib/Ia32/MathFtol.c > > create mode 100644 CryptoPkg/Library/OpensslLib/ossl_store.c > > create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool.c > > create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.c > > create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c > > > > Unfortunately, I've found another build issue with this series. (My > apologies that I didn't discover it earlier.) It is reported in the > 32-bit (ARM) build of the ArmVirtQemu platform: > > CryptoPkg/Library/OpensslLib/openssl/crypto/rand/drbg_lib.c:1028: > undefined reference to `__aeabi_ui2d' > > The referenced line is from the drbg_add() function: > > if (buflen < seedlen || randomness < (double) seedlen) { > > Beyond the failure to resolve the "__aeabi_ui2d" symbol, the edk2 coding > style spec says, "Floating point operations are not recommended in UEFI > firmware." (Even though the UEFI spec describes the required floating > point environment for all architectures.) > > So, I'm not sure what we should do here. If we think that floating point > is plain evil in edk2, then we cannot rebase edk2 to OpenSSL-1.1.1b. > > ... Hmmm, this seems to be the 32-bit ARM variant of [PATCH v4 3/7]! > > If we find floating point generally acceptable in edk2, then Ard and > Leif could help us decide please whether this 32-bit ARM issue should be > fixed during the feature freeze (when fixes are still allowed), or if it > justifies postponing OpenSSL 1.1.1b to the next edk2 stable tag. > > Again, I'm sorry that I found this only now -- but > "CryptoPkg/CryptoPkg.dsc" is multi-arch: > > SUPPORTED_ARCHITECTURES = IA32|X64|ARM|AARCH64 > > thus, preferably, a CryptoPkg patch series should be at least build > tested (if not boot tested) for all arches, before being posted to the > mailing list. > > (Yes, CI would help a lot with such issues.) > > Thanks > Laszlo ^ permalink raw reply [flat|nested] 39+ messages in thread
* Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b 2019-05-17 5:11 ` Wang, Jian J @ 2019-05-17 13:04 ` Laszlo Ersek 2019-05-17 13:16 ` Laszlo Ersek 0 siblings, 1 reply; 39+ messages in thread From: Laszlo Ersek @ 2019-05-17 13:04 UTC (permalink / raw) To: Wang, Jian J, devel@edk2.groups.io, Lu, XiaoyuX Cc: Ye, Ting, Ard Biesheuvel, Leif Lindholm, Gao, Liming On 05/17/19 07:11, Wang, Jian J wrote: > Hi Laszlo, > > There's already a float library used in OpensslLib.inf. > > [LibraryClasses.ARM] > ArmSoftFloatLib > > The problem is that the below instance doesn't implement __aeabi_ui2d > and __aeabi_d2uiz (I encountered this one as well) > > ArmPkg\Library\ArmSoftFloatLib\ArmSoftFloatLib.inf > > I think we can update this library support those two APIs. So what about > we still push the patch and file a BZ to fix this issue? I'm OK with that, but it will break ARM and AARCH64 platforms that consume OpensslLib (directly or through BaseCryptLib), so this question is up to Leif and Ard to decide. Thanks Laszlo >> -----Original Message----- >> From: Laszlo Ersek [mailto:lersek@redhat.com] >> Sent: Friday, May 17, 2019 2:26 AM >> To: devel@edk2.groups.io; Lu, XiaoyuX <xiaoyux.lu@intel.com> >> Cc: Wang, Jian J <jian.j.wang@intel.com>; Ye, Ting <ting.ye@intel.com>; Ard >> Biesheuvel <ard.biesheuvel@linaro.org>; Leif Lindholm >> <leif.lindholm@linaro.org> >> Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b >> >> Hi, >> >> (+ Ard and Leif) >> >> On 05/16/19 09:54, Xiaoyu lu wrote: >>> This series is also available at: >>> >> https://github.com/xiaoyuxlu/edk2/tree/bz_1089_upgrade_to_openssl_1_1_1b >> _v4 >>> >>> Changes: >>> >>> (1) CryptoPkgOpensslLib: Modify process_files.pl for upgrading OpenSSL >>> >>> (2) CryptoPkg/OpensslLib: Exclude unnecessary files in process_files.pl >>> crypto/store/* are excluded. >>> crypto/rand/randfile.c is excluded. >>> >>> (3) CryptoPkg/IntrinsicLib: Fix possible unresolved external symbol issue >>> >>> (4) CryptoPkg/OpensslLib: Prepare for upgrading OpenSSL >>> Disable warnings for buiding OpenSSL_1_1_1b >>> >>> (5) CryptoPkg/OpensslLib: Fix cross-build problem for AARCH64 >>> >>> (6) CryptoPkg: Upgrade OpenSSL to 1.1.1b >>> The biggest change is use TSC as entropy source >>> If TSC isn't avaiable, fallback to TimerLib(PerformanceCounter). >>> >>> (7) CryptoPkg/BaseCryptLib: Make HMAC_CTX size backward compatible >>> >>> >>> Verification done for this series: >>> * Https boot in OvmfPkg. >>> * BaseCrypt Library test. (Ovmf, EmulatorPkg) >>> >>> Important notice: >>> Nt32Pkg doesn't support TimerLib >>>> >> TimerLib|MdePkg/Library/BaseTimerLibNullTemplate/BaseTimerLibNullTemplat >> e.inf >>> So it will failed in Nt32Pkg. >>> >>> Cc: Jian J Wang <jian.j.wang@intel.com> >>> Cc: Ting Ye <ting.ye@intel.com> >>> >>> Laszlo Ersek (1): >>> CryptoPkg/OpensslLib: Fix cross-build problem for AARCH64 >>> >>> Xiaoyu Lu (6): >>> CryptoPkg/OpensslLib: Modify process_files.pl for upgrading OpenSSL >>> CryptoPkg/OpensslLib: Exclude unnecessary files in process_files.pl >>> CryptoPkg/IntrinsicLib: Fix possible unresolved external symbol issue >>> CryptoPkg/OpensslLib: Prepare for upgrading OpenSSL >>> CryptoPkg: Upgrade OpenSSL to 1.1.1b >>> CryptoPkg/BaseCryptLib: Make HMAC_CTX size backward compatible >>> >>> CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf | 4 +- >>> CryptoPkg/Library/OpensslLib/OpensslLib.inf | 76 ++++- >>> CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 67 ++++- >>> CryptoPkg/Library/Include/CrtLibSupport.h | 13 +- >>> CryptoPkg/Library/Include/openssl/opensslconf.h | 54 +++- >>> CryptoPkg/Library/Include/sys/syscall.h | 11 + >>> CryptoPkg/Library/OpensslLib/buildinf.h | 2 + >>> CryptoPkg/Library/OpensslLib/rand_pool_noise.h | 29 ++ >>> CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacMd5.c | 8 +- >>> .../Library/BaseCryptLib/Hmac/CryptHmacSha1.c | 9 +- >>> .../Library/BaseCryptLib/Hmac/CryptHmacSha256.c | 8 +- >>> CryptoPkg/Library/IntrinsicLib/Ia32/MathFtol.c | 22 ++ >>> CryptoPkg/Library/OpensslLib/ossl_store.c | 17 ++ >>> CryptoPkg/Library/OpensslLib/rand_pool.c | 316 >> +++++++++++++++++++++ >>> CryptoPkg/Library/OpensslLib/rand_pool_noise.c | 29 ++ >>> CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c | 43 +++ >>> CryptoPkg/Library/OpensslLib/openssl | 2 +- >>> CryptoPkg/Library/OpensslLib/process_files.pl | 11 +- >>> 18 files changed, 669 insertions(+), 52 deletions(-) >>> create mode 100644 CryptoPkg/Library/Include/sys/syscall.h >>> create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.h >>> create mode 100644 CryptoPkg/Library/IntrinsicLib/Ia32/MathFtol.c >>> create mode 100644 CryptoPkg/Library/OpensslLib/ossl_store.c >>> create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool.c >>> create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.c >>> create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c >>> >> >> Unfortunately, I've found another build issue with this series. (My >> apologies that I didn't discover it earlier.) It is reported in the >> 32-bit (ARM) build of the ArmVirtQemu platform: >> >> CryptoPkg/Library/OpensslLib/openssl/crypto/rand/drbg_lib.c:1028: >> undefined reference to `__aeabi_ui2d' >> >> The referenced line is from the drbg_add() function: >> >> if (buflen < seedlen || randomness < (double) seedlen) { >> >> Beyond the failure to resolve the "__aeabi_ui2d" symbol, the edk2 coding >> style spec says, "Floating point operations are not recommended in UEFI >> firmware." (Even though the UEFI spec describes the required floating >> point environment for all architectures.) >> >> So, I'm not sure what we should do here. If we think that floating point >> is plain evil in edk2, then we cannot rebase edk2 to OpenSSL-1.1.1b. >> >> ... Hmmm, this seems to be the 32-bit ARM variant of [PATCH v4 3/7]! >> >> If we find floating point generally acceptable in edk2, then Ard and >> Leif could help us decide please whether this 32-bit ARM issue should be >> fixed during the feature freeze (when fixes are still allowed), or if it >> justifies postponing OpenSSL 1.1.1b to the next edk2 stable tag. >> >> Again, I'm sorry that I found this only now -- but >> "CryptoPkg/CryptoPkg.dsc" is multi-arch: >> >> SUPPORTED_ARCHITECTURES = IA32|X64|ARM|AARCH64 >> >> thus, preferably, a CryptoPkg patch series should be at least build >> tested (if not boot tested) for all arches, before being posted to the >> mailing list. >> >> (Yes, CI would help a lot with such issues.) >> >> Thanks >> Laszlo ^ permalink raw reply [flat|nested] 39+ messages in thread
* Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b 2019-05-17 13:04 ` Laszlo Ersek @ 2019-05-17 13:16 ` Laszlo Ersek 2019-05-17 15:06 ` Ard Biesheuvel 0 siblings, 1 reply; 39+ messages in thread From: Laszlo Ersek @ 2019-05-17 13:16 UTC (permalink / raw) To: Wang, Jian J, devel@edk2.groups.io, Lu, XiaoyuX Cc: Ye, Ting, Ard Biesheuvel, Leif Lindholm, Gao, Liming On 05/17/19 15:04, Laszlo Ersek wrote: > On 05/17/19 07:11, Wang, Jian J wrote: >> Hi Laszlo, >> >> There's already a float library used in OpensslLib.inf. >> >> [LibraryClasses.ARM] >> ArmSoftFloatLib >> >> The problem is that the below instance doesn't implement __aeabi_ui2d >> and __aeabi_d2uiz (I encountered this one as well) >> >> ArmPkg\Library\ArmSoftFloatLib\ArmSoftFloatLib.inf >> >> I think we can update this library support those two APIs. So what about >> we still push the patch and file a BZ to fix this issue? > > I'm OK with that, but it will break ARM and AARCH64 platforms that > consume OpensslLib (directly or through BaseCryptLib), so this question > is up to Leif and Ard to decide. Correction: break ARM platforms only, not AARCH64. Laszlo > Thanks > Laszlo > >>> -----Original Message----- >>> From: Laszlo Ersek [mailto:lersek@redhat.com] >>> Sent: Friday, May 17, 2019 2:26 AM >>> To: devel@edk2.groups.io; Lu, XiaoyuX <xiaoyux.lu@intel.com> >>> Cc: Wang, Jian J <jian.j.wang@intel.com>; Ye, Ting <ting.ye@intel.com>; Ard >>> Biesheuvel <ard.biesheuvel@linaro.org>; Leif Lindholm >>> <leif.lindholm@linaro.org> >>> Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b >>> >>> Hi, >>> >>> (+ Ard and Leif) >>> >>> On 05/16/19 09:54, Xiaoyu lu wrote: >>>> This series is also available at: >>>> >>> https://github.com/xiaoyuxlu/edk2/tree/bz_1089_upgrade_to_openssl_1_1_1b >>> _v4 >>>> >>>> Changes: >>>> >>>> (1) CryptoPkgOpensslLib: Modify process_files.pl for upgrading OpenSSL >>>> >>>> (2) CryptoPkg/OpensslLib: Exclude unnecessary files in process_files.pl >>>> crypto/store/* are excluded. >>>> crypto/rand/randfile.c is excluded. >>>> >>>> (3) CryptoPkg/IntrinsicLib: Fix possible unresolved external symbol issue >>>> >>>> (4) CryptoPkg/OpensslLib: Prepare for upgrading OpenSSL >>>> Disable warnings for buiding OpenSSL_1_1_1b >>>> >>>> (5) CryptoPkg/OpensslLib: Fix cross-build problem for AARCH64 >>>> >>>> (6) CryptoPkg: Upgrade OpenSSL to 1.1.1b >>>> The biggest change is use TSC as entropy source >>>> If TSC isn't avaiable, fallback to TimerLib(PerformanceCounter). >>>> >>>> (7) CryptoPkg/BaseCryptLib: Make HMAC_CTX size backward compatible >>>> >>>> >>>> Verification done for this series: >>>> * Https boot in OvmfPkg. >>>> * BaseCrypt Library test. (Ovmf, EmulatorPkg) >>>> >>>> Important notice: >>>> Nt32Pkg doesn't support TimerLib >>>>> >>> TimerLib|MdePkg/Library/BaseTimerLibNullTemplate/BaseTimerLibNullTemplat >>> e.inf >>>> So it will failed in Nt32Pkg. >>>> >>>> Cc: Jian J Wang <jian.j.wang@intel.com> >>>> Cc: Ting Ye <ting.ye@intel.com> >>>> >>>> Laszlo Ersek (1): >>>> CryptoPkg/OpensslLib: Fix cross-build problem for AARCH64 >>>> >>>> Xiaoyu Lu (6): >>>> CryptoPkg/OpensslLib: Modify process_files.pl for upgrading OpenSSL >>>> CryptoPkg/OpensslLib: Exclude unnecessary files in process_files.pl >>>> CryptoPkg/IntrinsicLib: Fix possible unresolved external symbol issue >>>> CryptoPkg/OpensslLib: Prepare for upgrading OpenSSL >>>> CryptoPkg: Upgrade OpenSSL to 1.1.1b >>>> CryptoPkg/BaseCryptLib: Make HMAC_CTX size backward compatible >>>> >>>> CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf | 4 +- >>>> CryptoPkg/Library/OpensslLib/OpensslLib.inf | 76 ++++- >>>> CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 67 ++++- >>>> CryptoPkg/Library/Include/CrtLibSupport.h | 13 +- >>>> CryptoPkg/Library/Include/openssl/opensslconf.h | 54 +++- >>>> CryptoPkg/Library/Include/sys/syscall.h | 11 + >>>> CryptoPkg/Library/OpensslLib/buildinf.h | 2 + >>>> CryptoPkg/Library/OpensslLib/rand_pool_noise.h | 29 ++ >>>> CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacMd5.c | 8 +- >>>> .../Library/BaseCryptLib/Hmac/CryptHmacSha1.c | 9 +- >>>> .../Library/BaseCryptLib/Hmac/CryptHmacSha256.c | 8 +- >>>> CryptoPkg/Library/IntrinsicLib/Ia32/MathFtol.c | 22 ++ >>>> CryptoPkg/Library/OpensslLib/ossl_store.c | 17 ++ >>>> CryptoPkg/Library/OpensslLib/rand_pool.c | 316 >>> +++++++++++++++++++++ >>>> CryptoPkg/Library/OpensslLib/rand_pool_noise.c | 29 ++ >>>> CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c | 43 +++ >>>> CryptoPkg/Library/OpensslLib/openssl | 2 +- >>>> CryptoPkg/Library/OpensslLib/process_files.pl | 11 +- >>>> 18 files changed, 669 insertions(+), 52 deletions(-) >>>> create mode 100644 CryptoPkg/Library/Include/sys/syscall.h >>>> create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.h >>>> create mode 100644 CryptoPkg/Library/IntrinsicLib/Ia32/MathFtol.c >>>> create mode 100644 CryptoPkg/Library/OpensslLib/ossl_store.c >>>> create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool.c >>>> create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.c >>>> create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c >>>> >>> >>> Unfortunately, I've found another build issue with this series. (My >>> apologies that I didn't discover it earlier.) It is reported in the >>> 32-bit (ARM) build of the ArmVirtQemu platform: >>> >>> CryptoPkg/Library/OpensslLib/openssl/crypto/rand/drbg_lib.c:1028: >>> undefined reference to `__aeabi_ui2d' >>> >>> The referenced line is from the drbg_add() function: >>> >>> if (buflen < seedlen || randomness < (double) seedlen) { >>> >>> Beyond the failure to resolve the "__aeabi_ui2d" symbol, the edk2 coding >>> style spec says, "Floating point operations are not recommended in UEFI >>> firmware." (Even though the UEFI spec describes the required floating >>> point environment for all architectures.) >>> >>> So, I'm not sure what we should do here. If we think that floating point >>> is plain evil in edk2, then we cannot rebase edk2 to OpenSSL-1.1.1b. >>> >>> ... Hmmm, this seems to be the 32-bit ARM variant of [PATCH v4 3/7]! >>> >>> If we find floating point generally acceptable in edk2, then Ard and >>> Leif could help us decide please whether this 32-bit ARM issue should be >>> fixed during the feature freeze (when fixes are still allowed), or if it >>> justifies postponing OpenSSL 1.1.1b to the next edk2 stable tag. >>> >>> Again, I'm sorry that I found this only now -- but >>> "CryptoPkg/CryptoPkg.dsc" is multi-arch: >>> >>> SUPPORTED_ARCHITECTURES = IA32|X64|ARM|AARCH64 >>> >>> thus, preferably, a CryptoPkg patch series should be at least build >>> tested (if not boot tested) for all arches, before being posted to the >>> mailing list. >>> >>> (Yes, CI would help a lot with such issues.) >>> >>> Thanks >>> Laszlo > ^ permalink raw reply [flat|nested] 39+ messages in thread
* Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b 2019-05-17 13:16 ` Laszlo Ersek @ 2019-05-17 15:06 ` Ard Biesheuvel 2019-05-20 1:40 ` Wang, Jian J [not found] ` <15A0408CA29C0595.820@groups.io> 0 siblings, 2 replies; 39+ messages in thread From: Ard Biesheuvel @ 2019-05-17 15:06 UTC (permalink / raw) To: Laszlo Ersek Cc: Wang, Jian J, devel@edk2.groups.io, Lu, XiaoyuX, Ye, Ting, Leif Lindholm, Gao, Liming On Fri, 17 May 2019 at 15:17, Laszlo Ersek <lersek@redhat.com> wrote: > > On 05/17/19 15:04, Laszlo Ersek wrote: > > On 05/17/19 07:11, Wang, Jian J wrote: > >> Hi Laszlo, > >> > >> There's already a float library used in OpensslLib.inf. > >> > >> [LibraryClasses.ARM] > >> ArmSoftFloatLib > >> > >> The problem is that the below instance doesn't implement __aeabi_ui2d > >> and __aeabi_d2uiz (I encountered this one as well) > >> > >> ArmPkg\Library\ArmSoftFloatLib\ArmSoftFloatLib.inf > >> > >> I think we can update this library support those two APIs. So what about > >> we still push the patch and file a BZ to fix this issue? > > > > I'm OK with that, but it will break ARM and AARCH64 platforms that > > consume OpensslLib (directly or through BaseCryptLib), so this question > > is up to Leif and Ard to decide. > > Correction: break ARM platforms only, not AARCH64. > We obviously need to fix this before we can upgrade to a new OpenSSL version. Do we really have a need for the random functions? These seem the only ones that use floating point, which the UEFI spec does not permit, so it would be better if we could fix this by removing the dependency on FP in the first place (and get rid of ArmSoftFloatLib entirely) ^ permalink raw reply [flat|nested] 39+ messages in thread
* Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b 2019-05-17 15:06 ` Ard Biesheuvel @ 2019-05-20 1:40 ` Wang, Jian J [not found] ` <15A0408CA29C0595.820@groups.io> 1 sibling, 0 replies; 39+ messages in thread From: Wang, Jian J @ 2019-05-20 1:40 UTC (permalink / raw) To: devel@edk2.groups.io, ard.biesheuvel@linaro.org, Laszlo Ersek Cc: Lu, XiaoyuX, Ye, Ting, Leif Lindholm, Gao, Liming Ard, > -----Original Message----- > From: devel@edk2.groups.io [mailto:devel@edk2.groups.io] On Behalf Of Ard > Biesheuvel > Sent: Friday, May 17, 2019 11:06 PM > To: Laszlo Ersek <lersek@redhat.com> > Cc: Wang, Jian J <jian.j.wang@intel.com>; devel@edk2.groups.io; Lu, XiaoyuX > <xiaoyux.lu@intel.com>; Ye, Ting <ting.ye@intel.com>; Leif Lindholm > <leif.lindholm@linaro.org>; Gao, Liming <liming.gao@intel.com> > Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b > > On Fri, 17 May 2019 at 15:17, Laszlo Ersek <lersek@redhat.com> wrote: > > > > On 05/17/19 15:04, Laszlo Ersek wrote: > > > On 05/17/19 07:11, Wang, Jian J wrote: > > >> Hi Laszlo, > > >> > > >> There's already a float library used in OpensslLib.inf. > > >> > > >> [LibraryClasses.ARM] > > >> ArmSoftFloatLib > > >> > > >> The problem is that the below instance doesn't implement __aeabi_ui2d > > >> and __aeabi_d2uiz (I encountered this one as well) > > >> > > >> ArmPkg\Library\ArmSoftFloatLib\ArmSoftFloatLib.inf > > >> > > >> I think we can update this library support those two APIs. So what about > > >> we still push the patch and file a BZ to fix this issue? > > > > > > I'm OK with that, but it will break ARM and AARCH64 platforms that > > > consume OpensslLib (directly or through BaseCryptLib), so this question > > > is up to Leif and Ard to decide. > > > > Correction: break ARM platforms only, not AARCH64. > > > > We obviously need to fix this before we can upgrade to a new OpenSSL version. > > Do we really have a need for the random functions? These seem the only > ones that use floating point, which the UEFI spec does not permit, so > it would be better if we could fix this by removing the dependency on > FP in the first place (and get rid of ArmSoftFloatLib entirely) > BaseCryptLib provides RandSeed/RandBytes interface which wrap openssl rand functionalities. These interfaces are used by following components in edk2 - CryptoPkg\Library\TlsLib\TlsInit.c - SecurityPkg\HddPassword\HddPasswordDxe.c Openssl components, like asn1, bn, evp, ocsp, pem, pkcs7, pkcs12, rsa, ssl (in addition to cms, dsa, srp, which are disabled in edk2) will call rand_* interface as well. Regards, Jian > ^ permalink raw reply [flat|nested] 39+ messages in thread
[parent not found: <15A0408CA29C0595.820@groups.io>]
* Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b [not found] ` <15A0408CA29C0595.820@groups.io> @ 2019-05-21 7:43 ` Wang, Jian J 2019-05-21 9:01 ` Ard Biesheuvel 0 siblings, 1 reply; 39+ messages in thread From: Wang, Jian J @ 2019-05-21 7:43 UTC (permalink / raw) To: devel@edk2.groups.io, Wang, Jian J, ard.biesheuvel@linaro.org, Laszlo Ersek Cc: Lu, XiaoyuX, Ye, Ting, Leif Lindholm, Gao, Liming Hi Ard, Any comments? Regards, Jian > -----Original Message----- > From: devel@edk2.groups.io [mailto:devel@edk2.groups.io] On Behalf Of Wang, > Jian J > Sent: Monday, May 20, 2019 9:41 AM > To: devel@edk2.groups.io; ard.biesheuvel@linaro.org; Laszlo Ersek > <lersek@redhat.com> > Cc: Lu, XiaoyuX <xiaoyux.lu@intel.com>; Ye, Ting <ting.ye@intel.com>; Leif > Lindholm <leif.lindholm@linaro.org>; Gao, Liming <liming.gao@intel.com> > Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b > > Ard, > > > > -----Original Message----- > > From: devel@edk2.groups.io [mailto:devel@edk2.groups.io] On Behalf Of Ard > > Biesheuvel > > Sent: Friday, May 17, 2019 11:06 PM > > To: Laszlo Ersek <lersek@redhat.com> > > Cc: Wang, Jian J <jian.j.wang@intel.com>; devel@edk2.groups.io; Lu, XiaoyuX > > <xiaoyux.lu@intel.com>; Ye, Ting <ting.ye@intel.com>; Leif Lindholm > > <leif.lindholm@linaro.org>; Gao, Liming <liming.gao@intel.com> > > Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to > 1.1.1b > > > > On Fri, 17 May 2019 at 15:17, Laszlo Ersek <lersek@redhat.com> wrote: > > > > > > On 05/17/19 15:04, Laszlo Ersek wrote: > > > > On 05/17/19 07:11, Wang, Jian J wrote: > > > >> Hi Laszlo, > > > >> > > > >> There's already a float library used in OpensslLib.inf. > > > >> > > > >> [LibraryClasses.ARM] > > > >> ArmSoftFloatLib > > > >> > > > >> The problem is that the below instance doesn't implement __aeabi_ui2d > > > >> and __aeabi_d2uiz (I encountered this one as well) > > > >> > > > >> ArmPkg\Library\ArmSoftFloatLib\ArmSoftFloatLib.inf > > > >> > > > >> I think we can update this library support those two APIs. So what about > > > >> we still push the patch and file a BZ to fix this issue? > > > > > > > > I'm OK with that, but it will break ARM and AARCH64 platforms that > > > > consume OpensslLib (directly or through BaseCryptLib), so this question > > > > is up to Leif and Ard to decide. > > > > > > Correction: break ARM platforms only, not AARCH64. > > > > > > > We obviously need to fix this before we can upgrade to a new OpenSSL version. > > > > Do we really have a need for the random functions? These seem the only > > ones that use floating point, which the UEFI spec does not permit, so > > it would be better if we could fix this by removing the dependency on > > FP in the first place (and get rid of ArmSoftFloatLib entirely) > > > > BaseCryptLib provides RandSeed/RandBytes interface which wrap openssl rand > functionalities. These interfaces are used by following components in edk2 > > - CryptoPkg\Library\TlsLib\TlsInit.c > - SecurityPkg\HddPassword\HddPasswordDxe.c > > Openssl components, like asn1, bn, evp, ocsp, pem, pkcs7, pkcs12, rsa, ssl (in > addition > to cms, dsa, srp, which are disabled in edk2) will call rand_* interface as well. > > Regards, > Jian > > > > > > ^ permalink raw reply [flat|nested] 39+ messages in thread
* Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b 2019-05-21 7:43 ` Wang, Jian J @ 2019-05-21 9:01 ` Ard Biesheuvel 2019-05-21 9:09 ` Wang, Jian J 0 siblings, 1 reply; 39+ messages in thread From: Ard Biesheuvel @ 2019-05-21 9:01 UTC (permalink / raw) To: Wang, Jian J Cc: devel@edk2.groups.io, Laszlo Ersek, Lu, XiaoyuX, Ye, Ting, Leif Lindholm, Gao, Liming On Tue, 21 May 2019 at 09:43, Wang, Jian J <jian.j.wang@intel.com> wrote: > > Hi Ard, > > Any comments? > > Regards, > Jian > > > -----Original Message----- > > From: devel@edk2.groups.io [mailto:devel@edk2.groups.io] On Behalf Of Wang, > > Jian J > > Sent: Monday, May 20, 2019 9:41 AM > > To: devel@edk2.groups.io; ard.biesheuvel@linaro.org; Laszlo Ersek > > <lersek@redhat.com> > > Cc: Lu, XiaoyuX <xiaoyux.lu@intel.com>; Ye, Ting <ting.ye@intel.com>; Leif > > Lindholm <leif.lindholm@linaro.org>; Gao, Liming <liming.gao@intel.com> > > Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b > > > > Ard, > > > > > > > -----Original Message----- > > > From: devel@edk2.groups.io [mailto:devel@edk2.groups.io] On Behalf Of Ard > > > Biesheuvel > > > Sent: Friday, May 17, 2019 11:06 PM > > > To: Laszlo Ersek <lersek@redhat.com> > > > Cc: Wang, Jian J <jian.j.wang@intel.com>; devel@edk2.groups.io; Lu, XiaoyuX > > > <xiaoyux.lu@intel.com>; Ye, Ting <ting.ye@intel.com>; Leif Lindholm > > > <leif.lindholm@linaro.org>; Gao, Liming <liming.gao@intel.com> > > > Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to > > 1.1.1b > > > > > > On Fri, 17 May 2019 at 15:17, Laszlo Ersek <lersek@redhat.com> wrote: > > > > > > > > On 05/17/19 15:04, Laszlo Ersek wrote: > > > > > On 05/17/19 07:11, Wang, Jian J wrote: > > > > >> Hi Laszlo, > > > > >> > > > > >> There's already a float library used in OpensslLib.inf. > > > > >> > > > > >> [LibraryClasses.ARM] > > > > >> ArmSoftFloatLib > > > > >> > > > > >> The problem is that the below instance doesn't implement __aeabi_ui2d > > > > >> and __aeabi_d2uiz (I encountered this one as well) > > > > >> > > > > >> ArmPkg\Library\ArmSoftFloatLib\ArmSoftFloatLib.inf > > > > >> > > > > >> I think we can update this library support those two APIs. So what about > > > > >> we still push the patch and file a BZ to fix this issue? > > > > > > > > > > I'm OK with that, but it will break ARM and AARCH64 platforms that > > > > > consume OpensslLib (directly or through BaseCryptLib), so this question > > > > > is up to Leif and Ard to decide. > > > > > > > > Correction: break ARM platforms only, not AARCH64. > > > > > > > > > > We obviously need to fix this before we can upgrade to a new OpenSSL version. > > > > > > Do we really have a need for the random functions? These seem the only > > > ones that use floating point, which the UEFI spec does not permit, so > > > it would be better if we could fix this by removing the dependency on > > > FP in the first place (and get rid of ArmSoftFloatLib entirely) > > > > > > > BaseCryptLib provides RandSeed/RandBytes interface which wrap openssl rand > > functionalities. These interfaces are used by following components in edk2 > > > > - CryptoPkg\Library\TlsLib\TlsInit.c > > - SecurityPkg\HddPassword\HddPasswordDxe.c > > > > Openssl components, like asn1, bn, evp, ocsp, pem, pkcs7, pkcs12, rsa, ssl (in > > addition > > to cms, dsa, srp, which are disabled in edk2) will call rand_* interface as well. > > If we have both internal (to Openssl) and external users of the RNG api, then I guess there is no way to work around this. It is unfortunate, since the RNG code in OpenSSL doesn't actually use double types except for keeping an entropy count, which could just as easily be kept in an integer variable. So we will need to fix ArmSoftFloatLib before we can merge this OpenSSL update. I'm happy to help doing that, could you please summarize what we are missing today? ^ permalink raw reply [flat|nested] 39+ messages in thread
* Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b 2019-05-21 9:01 ` Ard Biesheuvel @ 2019-05-21 9:09 ` Wang, Jian J 2019-05-21 12:23 ` Laszlo Ersek 0 siblings, 1 reply; 39+ messages in thread From: Wang, Jian J @ 2019-05-21 9:09 UTC (permalink / raw) To: devel@edk2.groups.io, ard.biesheuvel@linaro.org Cc: Laszlo Ersek, Lu, XiaoyuX, Ye, Ting, Leif Lindholm, Gao, Liming Ard, > -----Original Message----- > From: devel@edk2.groups.io [mailto:devel@edk2.groups.io] On Behalf Of Ard > Biesheuvel > Sent: Tuesday, May 21, 2019 5:02 PM > To: Wang, Jian J <jian.j.wang@intel.com> > Cc: devel@edk2.groups.io; Laszlo Ersek <lersek@redhat.com>; Lu, XiaoyuX > <xiaoyux.lu@intel.com>; Ye, Ting <ting.ye@intel.com>; Leif Lindholm > <leif.lindholm@linaro.org>; Gao, Liming <liming.gao@intel.com> > Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b > > On Tue, 21 May 2019 at 09:43, Wang, Jian J <jian.j.wang@intel.com> wrote: > > > > Hi Ard, > > > > Any comments? > > > > Regards, > > Jian > > > > > -----Original Message----- > > > From: devel@edk2.groups.io [mailto:devel@edk2.groups.io] On Behalf Of > Wang, > > > Jian J > > > Sent: Monday, May 20, 2019 9:41 AM > > > To: devel@edk2.groups.io; ard.biesheuvel@linaro.org; Laszlo Ersek > > > <lersek@redhat.com> > > > Cc: Lu, XiaoyuX <xiaoyux.lu@intel.com>; Ye, Ting <ting.ye@intel.com>; Leif > > > Lindholm <leif.lindholm@linaro.org>; Gao, Liming <liming.gao@intel.com> > > > Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to > 1.1.1b > > > > > > Ard, > > > > > > > > > > -----Original Message----- > > > > From: devel@edk2.groups.io [mailto:devel@edk2.groups.io] On Behalf Of > Ard > > > > Biesheuvel > > > > Sent: Friday, May 17, 2019 11:06 PM > > > > To: Laszlo Ersek <lersek@redhat.com> > > > > Cc: Wang, Jian J <jian.j.wang@intel.com>; devel@edk2.groups.io; Lu, > XiaoyuX > > > > <xiaoyux.lu@intel.com>; Ye, Ting <ting.ye@intel.com>; Leif Lindholm > > > > <leif.lindholm@linaro.org>; Gao, Liming <liming.gao@intel.com> > > > > Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to > > > 1.1.1b > > > > > > > > On Fri, 17 May 2019 at 15:17, Laszlo Ersek <lersek@redhat.com> wrote: > > > > > > > > > > On 05/17/19 15:04, Laszlo Ersek wrote: > > > > > > On 05/17/19 07:11, Wang, Jian J wrote: > > > > > >> Hi Laszlo, > > > > > >> > > > > > >> There's already a float library used in OpensslLib.inf. > > > > > >> > > > > > >> [LibraryClasses.ARM] > > > > > >> ArmSoftFloatLib > > > > > >> > > > > > >> The problem is that the below instance doesn't implement > __aeabi_ui2d > > > > > >> and __aeabi_d2uiz (I encountered this one as well) > > > > > >> > > > > > >> ArmPkg\Library\ArmSoftFloatLib\ArmSoftFloatLib.inf > > > > > >> > > > > > >> I think we can update this library support those two APIs. So what > about > > > > > >> we still push the patch and file a BZ to fix this issue? > > > > > > > > > > > > I'm OK with that, but it will break ARM and AARCH64 platforms that > > > > > > consume OpensslLib (directly or through BaseCryptLib), so this question > > > > > > is up to Leif and Ard to decide. > > > > > > > > > > Correction: break ARM platforms only, not AARCH64. > > > > > > > > > > > > > We obviously need to fix this before we can upgrade to a new OpenSSL > version. > > > > > > > > Do we really have a need for the random functions? These seem the only > > > > ones that use floating point, which the UEFI spec does not permit, so > > > > it would be better if we could fix this by removing the dependency on > > > > FP in the first place (and get rid of ArmSoftFloatLib entirely) > > > > > > > > > > BaseCryptLib provides RandSeed/RandBytes interface which wrap openssl > rand > > > functionalities. These interfaces are used by following components in edk2 > > > > > > - CryptoPkg\Library\TlsLib\TlsInit.c > > > - SecurityPkg\HddPassword\HddPasswordDxe.c > > > > > > Openssl components, like asn1, bn, evp, ocsp, pem, pkcs7, pkcs12, rsa, ssl (in > > > addition > > > to cms, dsa, srp, which are disabled in edk2) will call rand_* interface as well. > > > > > If we have both internal (to Openssl) and external users of the RNG > api, then I guess there is no way to work around this. It is > unfortunate, since the RNG code in OpenSSL doesn't actually use double > types except for keeping an entropy count, which could just as easily > be kept in an integer variable. > > So we will need to fix ArmSoftFloatLib before we can merge this > OpenSSL update. I'm happy to help doing that, could you please > summarize what we are missing today? > Great. I think there're two intrinsic functions missing here __aeabi_ui2d __aeabi_d2uiz Laszlo, please double check if these two are enough. Thanks for doing this. Regards, Jian > ^ permalink raw reply [flat|nested] 39+ messages in thread
* Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b 2019-05-21 9:09 ` Wang, Jian J @ 2019-05-21 12:23 ` Laszlo Ersek 2019-05-21 13:02 ` Wang, Jian J 2019-05-21 13:39 ` Ard Biesheuvel 0 siblings, 2 replies; 39+ messages in thread From: Laszlo Ersek @ 2019-05-21 12:23 UTC (permalink / raw) To: Wang, Jian J, devel@edk2.groups.io, ard.biesheuvel@linaro.org Cc: Lu, XiaoyuX, Ye, Ting, Leif Lindholm, Gao, Liming Hi, On 05/21/19 11:09, Wang, Jian J wrote: > Ard, > >> -----Original Message----- >> From: devel@edk2.groups.io [mailto:devel@edk2.groups.io] On Behalf Of Ard >> Biesheuvel >> Sent: Tuesday, May 21, 2019 5:02 PM >> To: Wang, Jian J <jian.j.wang@intel.com> >> Cc: devel@edk2.groups.io; Laszlo Ersek <lersek@redhat.com>; Lu, XiaoyuX >> <xiaoyux.lu@intel.com>; Ye, Ting <ting.ye@intel.com>; Leif Lindholm >> <leif.lindholm@linaro.org>; Gao, Liming <liming.gao@intel.com> >> Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b >> >> On Tue, 21 May 2019 at 09:43, Wang, Jian J <jian.j.wang@intel.com> wrote: >>> >>> Hi Ard, >>> >>> Any comments? >>> >>> Regards, >>> Jian >>> >>>> -----Original Message----- >>>> From: devel@edk2.groups.io [mailto:devel@edk2.groups.io] On Behalf Of >> Wang, >>>> Jian J >>>> Sent: Monday, May 20, 2019 9:41 AM >>>> To: devel@edk2.groups.io; ard.biesheuvel@linaro.org; Laszlo Ersek >>>> <lersek@redhat.com> >>>> Cc: Lu, XiaoyuX <xiaoyux.lu@intel.com>; Ye, Ting <ting.ye@intel.com>; Leif >>>> Lindholm <leif.lindholm@linaro.org>; Gao, Liming <liming.gao@intel.com> >>>> Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to >> 1.1.1b >>>> >>>> Ard, >>>> >>>> >>>>> -----Original Message----- >>>>> From: devel@edk2.groups.io [mailto:devel@edk2.groups.io] On Behalf Of >> Ard >>>>> Biesheuvel >>>>> Sent: Friday, May 17, 2019 11:06 PM >>>>> To: Laszlo Ersek <lersek@redhat.com> >>>>> Cc: Wang, Jian J <jian.j.wang@intel.com>; devel@edk2.groups.io; Lu, >> XiaoyuX >>>>> <xiaoyux.lu@intel.com>; Ye, Ting <ting.ye@intel.com>; Leif Lindholm >>>>> <leif.lindholm@linaro.org>; Gao, Liming <liming.gao@intel.com> >>>>> Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to >>>> 1.1.1b >>>>> >>>>> On Fri, 17 May 2019 at 15:17, Laszlo Ersek <lersek@redhat.com> wrote: >>>>>> >>>>>> On 05/17/19 15:04, Laszlo Ersek wrote: >>>>>>> On 05/17/19 07:11, Wang, Jian J wrote: >>>>>>>> Hi Laszlo, >>>>>>>> >>>>>>>> There's already a float library used in OpensslLib.inf. >>>>>>>> >>>>>>>> [LibraryClasses.ARM] >>>>>>>> ArmSoftFloatLib >>>>>>>> >>>>>>>> The problem is that the below instance doesn't implement >> __aeabi_ui2d >>>>>>>> and __aeabi_d2uiz (I encountered this one as well) >>>>>>>> >>>>>>>> ArmPkg\Library\ArmSoftFloatLib\ArmSoftFloatLib.inf >>>>>>>> >>>>>>>> I think we can update this library support those two APIs. So what >> about >>>>>>>> we still push the patch and file a BZ to fix this issue? >>>>>>> >>>>>>> I'm OK with that, but it will break ARM and AARCH64 platforms that >>>>>>> consume OpensslLib (directly or through BaseCryptLib), so this question >>>>>>> is up to Leif and Ard to decide. >>>>>> >>>>>> Correction: break ARM platforms only, not AARCH64. >>>>>> >>>>> >>>>> We obviously need to fix this before we can upgrade to a new OpenSSL >> version. >>>>> >>>>> Do we really have a need for the random functions? These seem the only >>>>> ones that use floating point, which the UEFI spec does not permit, so >>>>> it would be better if we could fix this by removing the dependency on >>>>> FP in the first place (and get rid of ArmSoftFloatLib entirely) >>>>> >>>> >>>> BaseCryptLib provides RandSeed/RandBytes interface which wrap openssl >> rand >>>> functionalities. These interfaces are used by following components in edk2 >>>> >>>> - CryptoPkg\Library\TlsLib\TlsInit.c >>>> - SecurityPkg\HddPassword\HddPasswordDxe.c >>>> >>>> Openssl components, like asn1, bn, evp, ocsp, pem, pkcs7, pkcs12, rsa, ssl (in >>>> addition >>>> to cms, dsa, srp, which are disabled in edk2) will call rand_* interface as well. >>>> >> >> If we have both internal (to Openssl) and external users of the RNG >> api, then I guess there is no way to work around this. It is >> unfortunate, since the RNG code in OpenSSL doesn't actually use double >> types except for keeping an entropy count, which could just as easily >> be kept in an integer variable. (1) I think I agree... However, it seems that the first function (or one of the first functions) in OpenSSL to take an "entropy" parameter, of type "double", was RAND_add(). And the RAND_add() manual states, RAND_add() mixes the num bytes at buf into the PRNG state. Thus, if the data at buf are unpredictable to an adversary, this increases the uncertainty about the state and makes the PRNG output less predictable. Suitable input comes from user interaction (random key presses, mouse movements) and certain hardware events. The entropy argument is (the lower bound of) an estimate of how much randomness is contained in buf, measured in bytes. Details about sources of randomness and how to estimate their entropy can be found in the literature, e.g. RFC 1750. I've now looked up RFC 1750, and it contains copious amounts of math on irrational numbers. Hence the use of floating point in OpenSSL, I'd guess. https://www.ietf.org/rfc/rfc1750.txt ... After digging a bit in the OpenSSL git history, I've found the following commit (from 19 years ago): commit 853f757ecea74a271a7c5cdee3f3b5fe0d3ae863 Author: Bodo Möller <bodo@openssl.org> Date: Sat Feb 19 15:22:53 2000 +0000 Allow for higher granularity of entropy estimates by using 'double' instead of 'unsigned' counters. Seed PRNG in MacOS/GetHTTPS.src/GetHTTPS.cpp. Partially submitted by Yoram Meroz <yoram@mail.idrive.com>. It was the commit with -void RAND_add(const void *buf,int num,int entropy); +void RAND_add(const void *buf,int num,double entropy); FWIW, the "PRNG" reference at the end of the commit message seems meaningless. Check for yourself: $ git show 853f757ecea7:MacOS/GetHTTPS.src/GetHTTPS.cpp The fact that "entropy" is now of type "double" does not seem to be put to use, anywhere in that file. I'll send a query to the openssl-users mailing list, just so we understand better. >> So we will need to fix ArmSoftFloatLib before we can merge this >> OpenSSL update. (2) NB, I think we can no longer merge this feature for edk2-stable201905. The soft feature freeze criterion is that all patches be reviewed (approved) on-list before the SFF date / announcement, and that was not fulfilled in this case. >> I'm happy to help doing that, could you please >> summarize what we are missing today? >> > > Great. I think there're two intrinsic functions missing here > > __aeabi_ui2d > __aeabi_d2uiz > > Laszlo, please double check if these two are enough. (3) I can only report the failure that trips up the build for me. I did that here: http://mid.mail-archive.com/049e489c-b58f-0fc5-1c66-8ad920d93979@redhat.com https://edk2.groups.io/g/devel/message/40823 Thus, for me, the missing symbol was "__aeabi_ui2d". It's possible that the 32-bit ARM build will fail at a different (later) stage as well, but I can't tell until I get past this one. (And I don't think I can implement a "shim" function for the missing symbol, just to let the build progress.) Thanks, Laszlo > Thanks for doing this. > > Regards, > Jian > >> > ^ permalink raw reply [flat|nested] 39+ messages in thread
* Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b 2019-05-21 12:23 ` Laszlo Ersek @ 2019-05-21 13:02 ` Wang, Jian J 2019-05-21 13:34 ` Laszlo Ersek 2019-05-21 13:39 ` Ard Biesheuvel 1 sibling, 1 reply; 39+ messages in thread From: Wang, Jian J @ 2019-05-21 13:02 UTC (permalink / raw) To: devel@edk2.groups.io, lersek@redhat.com, ard.biesheuvel@linaro.org Cc: Lu, XiaoyuX, Ye, Ting, Leif Lindholm, Gao, Liming Laszlo, > -----Original Message----- > From: devel@edk2.groups.io [mailto:devel@edk2.groups.io] On Behalf Of > Laszlo Ersek > Sent: Tuesday, May 21, 2019 8:24 PM > To: Wang, Jian J <jian.j.wang@intel.com>; devel@edk2.groups.io; > ard.biesheuvel@linaro.org > Cc: Lu, XiaoyuX <xiaoyux.lu@intel.com>; Ye, Ting <ting.ye@intel.com>; Leif > Lindholm <leif.lindholm@linaro.org>; Gao, Liming <liming.gao@intel.com> > Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b > > Hi, > > On 05/21/19 11:09, Wang, Jian J wrote: > > Ard, > > > >> -----Original Message----- > >> From: devel@edk2.groups.io [mailto:devel@edk2.groups.io] On Behalf Of > Ard > >> Biesheuvel > >> Sent: Tuesday, May 21, 2019 5:02 PM > >> To: Wang, Jian J <jian.j.wang@intel.com> > >> Cc: devel@edk2.groups.io; Laszlo Ersek <lersek@redhat.com>; Lu, XiaoyuX > >> <xiaoyux.lu@intel.com>; Ye, Ting <ting.ye@intel.com>; Leif Lindholm > >> <leif.lindholm@linaro.org>; Gao, Liming <liming.gao@intel.com> > >> Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to > 1.1.1b > >> > >> On Tue, 21 May 2019 at 09:43, Wang, Jian J <jian.j.wang@intel.com> wrote: > >>> > >>> Hi Ard, > >>> > >>> Any comments? > >>> > >>> Regards, > >>> Jian > >>> > >>>> -----Original Message----- > >>>> From: devel@edk2.groups.io [mailto:devel@edk2.groups.io] On Behalf Of > >> Wang, > >>>> Jian J > >>>> Sent: Monday, May 20, 2019 9:41 AM > >>>> To: devel@edk2.groups.io; ard.biesheuvel@linaro.org; Laszlo Ersek > >>>> <lersek@redhat.com> > >>>> Cc: Lu, XiaoyuX <xiaoyux.lu@intel.com>; Ye, Ting <ting.ye@intel.com>; > Leif > >>>> Lindholm <leif.lindholm@linaro.org>; Gao, Liming <liming.gao@intel.com> > >>>> Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to > >> 1.1.1b > >>>> > >>>> Ard, > >>>> > >>>> > >>>>> -----Original Message----- > >>>>> From: devel@edk2.groups.io [mailto:devel@edk2.groups.io] On Behalf > Of > >> Ard > >>>>> Biesheuvel > >>>>> Sent: Friday, May 17, 2019 11:06 PM > >>>>> To: Laszlo Ersek <lersek@redhat.com> > >>>>> Cc: Wang, Jian J <jian.j.wang@intel.com>; devel@edk2.groups.io; Lu, > >> XiaoyuX > >>>>> <xiaoyux.lu@intel.com>; Ye, Ting <ting.ye@intel.com>; Leif Lindholm > >>>>> <leif.lindholm@linaro.org>; Gao, Liming <liming.gao@intel.com> > >>>>> Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to > >>>> 1.1.1b > >>>>> > >>>>> On Fri, 17 May 2019 at 15:17, Laszlo Ersek <lersek@redhat.com> wrote: > >>>>>> > >>>>>> On 05/17/19 15:04, Laszlo Ersek wrote: > >>>>>>> On 05/17/19 07:11, Wang, Jian J wrote: > >>>>>>>> Hi Laszlo, > >>>>>>>> > >>>>>>>> There's already a float library used in OpensslLib.inf. > >>>>>>>> > >>>>>>>> [LibraryClasses.ARM] > >>>>>>>> ArmSoftFloatLib > >>>>>>>> > >>>>>>>> The problem is that the below instance doesn't implement > >> __aeabi_ui2d > >>>>>>>> and __aeabi_d2uiz (I encountered this one as well) > >>>>>>>> > >>>>>>>> ArmPkg\Library\ArmSoftFloatLib\ArmSoftFloatLib.inf > >>>>>>>> > >>>>>>>> I think we can update this library support those two APIs. So what > >> about > >>>>>>>> we still push the patch and file a BZ to fix this issue? > >>>>>>> > >>>>>>> I'm OK with that, but it will break ARM and AARCH64 platforms that > >>>>>>> consume OpensslLib (directly or through BaseCryptLib), so this question > >>>>>>> is up to Leif and Ard to decide. > >>>>>> > >>>>>> Correction: break ARM platforms only, not AARCH64. > >>>>>> > >>>>> > >>>>> We obviously need to fix this before we can upgrade to a new OpenSSL > >> version. > >>>>> > >>>>> Do we really have a need for the random functions? These seem the only > >>>>> ones that use floating point, which the UEFI spec does not permit, so > >>>>> it would be better if we could fix this by removing the dependency on > >>>>> FP in the first place (and get rid of ArmSoftFloatLib entirely) > >>>>> > >>>> > >>>> BaseCryptLib provides RandSeed/RandBytes interface which wrap openssl > >> rand > >>>> functionalities. These interfaces are used by following components in edk2 > >>>> > >>>> - CryptoPkg\Library\TlsLib\TlsInit.c > >>>> - SecurityPkg\HddPassword\HddPasswordDxe.c > >>>> > >>>> Openssl components, like asn1, bn, evp, ocsp, pem, pkcs7, pkcs12, rsa, ssl > (in > >>>> addition > >>>> to cms, dsa, srp, which are disabled in edk2) will call rand_* interface as > well. > >>>> > >> > >> If we have both internal (to Openssl) and external users of the RNG > >> api, then I guess there is no way to work around this. It is > >> unfortunate, since the RNG code in OpenSSL doesn't actually use double > >> types except for keeping an entropy count, which could just as easily > >> be kept in an integer variable. > > (1) I think I agree... However, it seems that the first function (or one > of the first functions) in OpenSSL to take an "entropy" parameter, of > type "double", was RAND_add(). And the RAND_add() manual states, > > RAND_add() mixes the num bytes at buf into the PRNG state. > Thus, if the data at buf are unpredictable to an adversary, > this increases the uncertainty about the state and makes the > PRNG output less predictable. Suitable input comes from user > interaction (random key presses, mouse movements) and certain > hardware events. The entropy argument is (the lower bound of) > an estimate of how much randomness is contained in buf, > measured in bytes. Details about sources of randomness and how > to estimate their entropy can be found in the literature, e.g. > RFC 1750. > > I've now looked up RFC 1750, and it contains copious amounts of math on > irrational numbers. Hence the use of floating point in OpenSSL, I'd guess. > > https://www.ietf.org/rfc/rfc1750.txt > > ... After digging a bit in the OpenSSL git history, I've found the > following commit (from 19 years ago): > > commit 853f757ecea74a271a7c5cdee3f3b5fe0d3ae863 > Author: Bodo Möller <bodo@openssl.org> > Date: Sat Feb 19 15:22:53 2000 +0000 > > Allow for higher granularity of entropy estimates by using 'double' > instead of 'unsigned' counters. > Seed PRNG in MacOS/GetHTTPS.src/GetHTTPS.cpp. > > Partially submitted by Yoram Meroz <yoram@mail.idrive.com>. > > It was the commit with > > -void RAND_add(const void *buf,int num,int entropy); > +void RAND_add(const void *buf,int num,double entropy); > > FWIW, the "PRNG" reference at the end of the commit message seems > meaningless. Check for yourself: > > $ git show 853f757ecea7:MacOS/GetHTTPS.src/GetHTTPS.cpp > > The fact that "entropy" is now of type "double" does not seem to be put > to use, anywhere in that file. > > I'll send a query to the openssl-users mailing list, just so we > understand better. > > That's a good digging. Thanks for doing this. > >> So we will need to fix ArmSoftFloatLib before we can merge this > >> OpenSSL update. > > (2) NB, I think we can no longer merge this feature for > edk2-stable201905. The soft feature freeze criterion is that all patches > be reviewed (approved) on-list before the SFF date / announcement, and > that was not fulfilled in this case. > You're right. But we still need to complete the upgrade ASAP after stable tag. There're several other features pending on it. > > >> I'm happy to help doing that, could you please > >> summarize what we are missing today? > >> > > > > Great. I think there're two intrinsic functions missing here > > > > __aeabi_ui2d > > __aeabi_d2uiz > > > > Laszlo, please double check if these two are enough. > > (3) I can only report the failure that trips up the build for me. I did > that here: > > http://mid.mail-archive.com/049e489c-b58f-0fc5-1c66- > 8ad920d93979@redhat.com > https://edk2.groups.io/g/devel/message/40823 > > > Thus, for me, the missing symbol was "__aeabi_ui2d". > > It's possible that the 32-bit ARM build will fail at a different (later) > stage as well, but I can't tell until I get past this one. (And I don't > think I can implement a "shim" function for the missing symbol, just to > let the build progress.) > I got __aeabi_d2uiz reported missing, in addition to __aeabi_ui2d, if I build with cross-compiler arm-linux-gnueabi-gcc-5. Using dummy implementations of both them can make build pass. Any chances the real implementation of these functions cause other missing symbol? Regards, Jian > Thanks, > Laszlo > > > Thanks for doing this. > > > > Regards, > > Jian > > > >> > > > > > ^ permalink raw reply [flat|nested] 39+ messages in thread
* Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b 2019-05-21 13:02 ` Wang, Jian J @ 2019-05-21 13:34 ` Laszlo Ersek 0 siblings, 0 replies; 39+ messages in thread From: Laszlo Ersek @ 2019-05-21 13:34 UTC (permalink / raw) To: Wang, Jian J, devel@edk2.groups.io, ard.biesheuvel@linaro.org Cc: Lu, XiaoyuX, Ye, Ting, Leif Lindholm, Gao, Liming On 05/21/19 15:02, Wang, Jian J wrote: >> -----Original Message----- >> From: devel@edk2.groups.io [mailto:devel@edk2.groups.io] On Behalf Of >> Laszlo Ersek >> Sent: Tuesday, May 21, 2019 8:24 PM >> To: Wang, Jian J <jian.j.wang@intel.com>; devel@edk2.groups.io; >> ard.biesheuvel@linaro.org >> Cc: Lu, XiaoyuX <xiaoyux.lu@intel.com>; Ye, Ting <ting.ye@intel.com>; Leif >> Lindholm <leif.lindholm@linaro.org>; Gao, Liming <liming.gao@intel.com> >> Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b >> (2) NB, I think we can no longer merge this feature for >> edk2-stable201905. The soft feature freeze criterion is that all patches >> be reviewed (approved) on-list before the SFF date / announcement, and >> that was not fulfilled in this case. >> > > You're right. But we still need to complete the upgrade ASAP after stable tag. > There're several other features pending on it. True! >> (3) I can only report the failure that trips up the build for me. I did >> that here: >> >> http://mid.mail-archive.com/049e489c-b58f-0fc5-1c66- >> 8ad920d93979@redhat.com >> https://edk2.groups.io/g/devel/message/40823 >> >> >> Thus, for me, the missing symbol was "__aeabi_ui2d". >> >> It's possible that the 32-bit ARM build will fail at a different (later) >> stage as well, but I can't tell until I get past this one. (And I don't >> think I can implement a "shim" function for the missing symbol, just to >> let the build progress.) >> > > I got __aeabi_d2uiz reported missing, in addition to __aeabi_ui2d, if > I build with cross-compiler arm-linux-gnueabi-gcc-5. Using dummy > implementations of both them can make build pass. Any chances the > real implementation of these functions cause other missing symbol? (I'll let Ard answer this.) Thanks Laszlo ^ permalink raw reply [flat|nested] 39+ messages in thread
* Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b 2019-05-21 12:23 ` Laszlo Ersek 2019-05-21 13:02 ` Wang, Jian J @ 2019-05-21 13:39 ` Ard Biesheuvel 2019-05-23 5:10 ` Wang, Jian J 1 sibling, 1 reply; 39+ messages in thread From: Ard Biesheuvel @ 2019-05-21 13:39 UTC (permalink / raw) To: Laszlo Ersek Cc: Wang, Jian J, devel@edk2.groups.io, Lu, XiaoyuX, Ye, Ting, Leif Lindholm, Gao, Liming On Tue, 21 May 2019 at 13:23, Laszlo Ersek <lersek@redhat.com> wrote: > > Hi, > > On 05/21/19 11:09, Wang, Jian J wrote: > > Ard, > > > >> -----Original Message----- > >> From: devel@edk2.groups.io [mailto:devel@edk2.groups.io] On Behalf Of Ard > >> Biesheuvel > >> Sent: Tuesday, May 21, 2019 5:02 PM > >> To: Wang, Jian J <jian.j.wang@intel.com> > >> Cc: devel@edk2.groups.io; Laszlo Ersek <lersek@redhat.com>; Lu, XiaoyuX > >> <xiaoyux.lu@intel.com>; Ye, Ting <ting.ye@intel.com>; Leif Lindholm > >> <leif.lindholm@linaro.org>; Gao, Liming <liming.gao@intel.com> > >> Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b > >> > >> On Tue, 21 May 2019 at 09:43, Wang, Jian J <jian.j.wang@intel.com> wrote: > >>> > >>> Hi Ard, > >>> > >>> Any comments? > >>> > >>> Regards, > >>> Jian > >>> > >>>> -----Original Message----- > >>>> From: devel@edk2.groups.io [mailto:devel@edk2.groups.io] On Behalf Of > >> Wang, > >>>> Jian J > >>>> Sent: Monday, May 20, 2019 9:41 AM > >>>> To: devel@edk2.groups.io; ard.biesheuvel@linaro.org; Laszlo Ersek > >>>> <lersek@redhat.com> > >>>> Cc: Lu, XiaoyuX <xiaoyux.lu@intel.com>; Ye, Ting <ting.ye@intel.com>; Leif > >>>> Lindholm <leif.lindholm@linaro.org>; Gao, Liming <liming.gao@intel.com> > >>>> Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to > >> 1.1.1b > >>>> > >>>> Ard, > >>>> > >>>> > >>>>> -----Original Message----- > >>>>> From: devel@edk2.groups.io [mailto:devel@edk2.groups.io] On Behalf Of > >> Ard > >>>>> Biesheuvel > >>>>> Sent: Friday, May 17, 2019 11:06 PM > >>>>> To: Laszlo Ersek <lersek@redhat.com> > >>>>> Cc: Wang, Jian J <jian.j.wang@intel.com>; devel@edk2.groups.io; Lu, > >> XiaoyuX > >>>>> <xiaoyux.lu@intel.com>; Ye, Ting <ting.ye@intel.com>; Leif Lindholm > >>>>> <leif.lindholm@linaro.org>; Gao, Liming <liming.gao@intel.com> > >>>>> Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to > >>>> 1.1.1b > >>>>> > >>>>> On Fri, 17 May 2019 at 15:17, Laszlo Ersek <lersek@redhat.com> wrote: > >>>>>> > >>>>>> On 05/17/19 15:04, Laszlo Ersek wrote: > >>>>>>> On 05/17/19 07:11, Wang, Jian J wrote: > >>>>>>>> Hi Laszlo, > >>>>>>>> > >>>>>>>> There's already a float library used in OpensslLib.inf. > >>>>>>>> > >>>>>>>> [LibraryClasses.ARM] > >>>>>>>> ArmSoftFloatLib > >>>>>>>> > >>>>>>>> The problem is that the below instance doesn't implement > >> __aeabi_ui2d > >>>>>>>> and __aeabi_d2uiz (I encountered this one as well) > >>>>>>>> > >>>>>>>> ArmPkg\Library\ArmSoftFloatLib\ArmSoftFloatLib.inf > >>>>>>>> > >>>>>>>> I think we can update this library support those two APIs. So what > >> about > >>>>>>>> we still push the patch and file a BZ to fix this issue? > >>>>>>> > >>>>>>> I'm OK with that, but it will break ARM and AARCH64 platforms that > >>>>>>> consume OpensslLib (directly or through BaseCryptLib), so this question > >>>>>>> is up to Leif and Ard to decide. > >>>>>> > >>>>>> Correction: break ARM platforms only, not AARCH64. > >>>>>> > >>>>> > >>>>> We obviously need to fix this before we can upgrade to a new OpenSSL > >> version. > >>>>> > >>>>> Do we really have a need for the random functions? These seem the only > >>>>> ones that use floating point, which the UEFI spec does not permit, so > >>>>> it would be better if we could fix this by removing the dependency on > >>>>> FP in the first place (and get rid of ArmSoftFloatLib entirely) > >>>>> > >>>> > >>>> BaseCryptLib provides RandSeed/RandBytes interface which wrap openssl > >> rand > >>>> functionalities. These interfaces are used by following components in edk2 > >>>> > >>>> - CryptoPkg\Library\TlsLib\TlsInit.c > >>>> - SecurityPkg\HddPassword\HddPasswordDxe.c > >>>> > >>>> Openssl components, like asn1, bn, evp, ocsp, pem, pkcs7, pkcs12, rsa, ssl (in > >>>> addition > >>>> to cms, dsa, srp, which are disabled in edk2) will call rand_* interface as well. > >>>> > >> > >> If we have both internal (to Openssl) and external users of the RNG > >> api, then I guess there is no way to work around this. It is > >> unfortunate, since the RNG code in OpenSSL doesn't actually use double > >> types except for keeping an entropy count, which could just as easily > >> be kept in an integer variable. > > (1) I think I agree... However, it seems that the first function (or one > of the first functions) in OpenSSL to take an "entropy" parameter, of > type "double", was RAND_add(). And the RAND_add() manual states, > > RAND_add() mixes the num bytes at buf into the PRNG state. > Thus, if the data at buf are unpredictable to an adversary, > this increases the uncertainty about the state and makes the > PRNG output less predictable. Suitable input comes from user > interaction (random key presses, mouse movements) and certain > hardware events. The entropy argument is (the lower bound of) > an estimate of how much randomness is contained in buf, > measured in bytes. Details about sources of randomness and how > to estimate their entropy can be found in the literature, e.g. > RFC 1750. > > I've now looked up RFC 1750, and it contains copious amounts of math on > irrational numbers. Hence the use of floating point in OpenSSL, I'd guess. > > https://www.ietf.org/rfc/rfc1750.txt > > ... After digging a bit in the OpenSSL git history, I've found the > following commit (from 19 years ago): > > commit 853f757ecea74a271a7c5cdee3f3b5fe0d3ae863 > Author: Bodo Möller <bodo@openssl.org> > Date: Sat Feb 19 15:22:53 2000 +0000 > > Allow for higher granularity of entropy estimates by using 'double' > instead of 'unsigned' counters. > Seed PRNG in MacOS/GetHTTPS.src/GetHTTPS.cpp. > > Partially submitted by Yoram Meroz <yoram@mail.idrive.com>. > > It was the commit with > > -void RAND_add(const void *buf,int num,int entropy); > +void RAND_add(const void *buf,int num,double entropy); > > FWIW, the "PRNG" reference at the end of the commit message seems > meaningless. Check for yourself: > > $ git show 853f757ecea7:MacOS/GetHTTPS.src/GetHTTPS.cpp > > The fact that "entropy" is now of type "double" does not seem to be put > to use, anywhere in that file. > > I'll send a query to the openssl-users mailing list, just so we > understand better. > Thanks for doing the paleontological research here. However, the outcome of this query is not going to affect our short term issue with this code. I will try to come back to this issue as soon as I can, but I am a bit swamped at the moment. > > >> So we will need to fix ArmSoftFloatLib before we can merge this > >> OpenSSL update. > > (2) NB, I think we can no longer merge this feature for > edk2-stable201905. The soft feature freeze criterion is that all patches > be reviewed (approved) on-list before the SFF date / announcement, and > that was not fulfilled in this case. > > > >> I'm happy to help doing that, could you please > >> summarize what we are missing today? > >> > > > > Great. I think there're two intrinsic functions missing here > > > > __aeabi_ui2d > > __aeabi_d2uiz > > > > Laszlo, please double check if these two are enough. > > (3) I can only report the failure that trips up the build for me. I did > that here: > > http://mid.mail-archive.com/049e489c-b58f-0fc5-1c66-8ad920d93979@redhat.com > https://edk2.groups.io/g/devel/message/40823 > > > Thus, for me, the missing symbol was "__aeabi_ui2d". > > It's possible that the 32-bit ARM build will fail at a different (later) > stage as well, but I can't tell until I get past this one. (And I don't > think I can implement a "shim" function for the missing symbol, just to > let the build progress.) > > Thanks, > Laszlo > > > Thanks for doing this. > > > > Regards, > > Jian > > > >> > > > ^ permalink raw reply [flat|nested] 39+ messages in thread
* Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b 2019-05-21 13:39 ` Ard Biesheuvel @ 2019-05-23 5:10 ` Wang, Jian J 0 siblings, 0 replies; 39+ messages in thread From: Wang, Jian J @ 2019-05-23 5:10 UTC (permalink / raw) To: devel@edk2.groups.io, ard.biesheuvel@linaro.org, Laszlo Ersek Cc: Lu, XiaoyuX, Ye, Ting, Leif Lindholm, Gao, Liming Ard, > -----Original Message----- > From: devel@edk2.groups.io [mailto:devel@edk2.groups.io] On Behalf Of Ard > Biesheuvel > Sent: Tuesday, May 21, 2019 9:39 PM > To: Laszlo Ersek <lersek@redhat.com> > Cc: Wang, Jian J <jian.j.wang@intel.com>; devel@edk2.groups.io; Lu, XiaoyuX > <xiaoyux.lu@intel.com>; Ye, Ting <ting.ye@intel.com>; Leif Lindholm > <leif.lindholm@linaro.org>; Gao, Liming <liming.gao@intel.com> > Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b > > On Tue, 21 May 2019 at 13:23, Laszlo Ersek <lersek@redhat.com> wrote: > > > > Hi, > > > > On 05/21/19 11:09, Wang, Jian J wrote: > > > Ard, > > > > > >> -----Original Message----- > > >> From: devel@edk2.groups.io [mailto:devel@edk2.groups.io] On Behalf Of > Ard > > >> Biesheuvel > > >> Sent: Tuesday, May 21, 2019 5:02 PM > > >> To: Wang, Jian J <jian.j.wang@intel.com> > > >> Cc: devel@edk2.groups.io; Laszlo Ersek <lersek@redhat.com>; Lu, XiaoyuX > > >> <xiaoyux.lu@intel.com>; Ye, Ting <ting.ye@intel.com>; Leif Lindholm > > >> <leif.lindholm@linaro.org>; Gao, Liming <liming.gao@intel.com> > > >> Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to > 1.1.1b > > >> > > >> On Tue, 21 May 2019 at 09:43, Wang, Jian J <jian.j.wang@intel.com> wrote: > > >>> > > >>> Hi Ard, > > >>> > > >>> Any comments? > > >>> > > >>> Regards, > > >>> Jian > > >>> > > >>>> -----Original Message----- > > >>>> From: devel@edk2.groups.io [mailto:devel@edk2.groups.io] On Behalf > Of > > >> Wang, > > >>>> Jian J > > >>>> Sent: Monday, May 20, 2019 9:41 AM > > >>>> To: devel@edk2.groups.io; ard.biesheuvel@linaro.org; Laszlo Ersek > > >>>> <lersek@redhat.com> > > >>>> Cc: Lu, XiaoyuX <xiaoyux.lu@intel.com>; Ye, Ting <ting.ye@intel.com>; > Leif > > >>>> Lindholm <leif.lindholm@linaro.org>; Gao, Liming > <liming.gao@intel.com> > > >>>> Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to > > >> 1.1.1b > > >>>> > > >>>> Ard, > > >>>> > > >>>> > > >>>>> -----Original Message----- > > >>>>> From: devel@edk2.groups.io [mailto:devel@edk2.groups.io] On Behalf > Of > > >> Ard > > >>>>> Biesheuvel > > >>>>> Sent: Friday, May 17, 2019 11:06 PM > > >>>>> To: Laszlo Ersek <lersek@redhat.com> > > >>>>> Cc: Wang, Jian J <jian.j.wang@intel.com>; devel@edk2.groups.io; Lu, > > >> XiaoyuX > > >>>>> <xiaoyux.lu@intel.com>; Ye, Ting <ting.ye@intel.com>; Leif Lindholm > > >>>>> <leif.lindholm@linaro.org>; Gao, Liming <liming.gao@intel.com> > > >>>>> Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL > to > > >>>> 1.1.1b > > >>>>> > > >>>>> On Fri, 17 May 2019 at 15:17, Laszlo Ersek <lersek@redhat.com> wrote: > > >>>>>> > > >>>>>> On 05/17/19 15:04, Laszlo Ersek wrote: > > >>>>>>> On 05/17/19 07:11, Wang, Jian J wrote: > > >>>>>>>> Hi Laszlo, > > >>>>>>>> > > >>>>>>>> There's already a float library used in OpensslLib.inf. > > >>>>>>>> > > >>>>>>>> [LibraryClasses.ARM] > > >>>>>>>> ArmSoftFloatLib > > >>>>>>>> > > >>>>>>>> The problem is that the below instance doesn't implement > > >> __aeabi_ui2d > > >>>>>>>> and __aeabi_d2uiz (I encountered this one as well) > > >>>>>>>> > > >>>>>>>> ArmPkg\Library\ArmSoftFloatLib\ArmSoftFloatLib.inf > > >>>>>>>> > > >>>>>>>> I think we can update this library support those two APIs. So what > > >> about > > >>>>>>>> we still push the patch and file a BZ to fix this issue? > > >>>>>>> > > >>>>>>> I'm OK with that, but it will break ARM and AARCH64 platforms that > > >>>>>>> consume OpensslLib (directly or through BaseCryptLib), so this > question > > >>>>>>> is up to Leif and Ard to decide. > > >>>>>> > > >>>>>> Correction: break ARM platforms only, not AARCH64. > > >>>>>> > > >>>>> > > >>>>> We obviously need to fix this before we can upgrade to a new OpenSSL > > >> version. > > >>>>> > > >>>>> Do we really have a need for the random functions? These seem the > only > > >>>>> ones that use floating point, which the UEFI spec does not permit, so > > >>>>> it would be better if we could fix this by removing the dependency on > > >>>>> FP in the first place (and get rid of ArmSoftFloatLib entirely) > > >>>>> > > >>>> > > >>>> BaseCryptLib provides RandSeed/RandBytes interface which wrap > openssl > > >> rand > > >>>> functionalities. These interfaces are used by following components in > edk2 > > >>>> > > >>>> - CryptoPkg\Library\TlsLib\TlsInit.c > > >>>> - SecurityPkg\HddPassword\HddPasswordDxe.c > > >>>> > > >>>> Openssl components, like asn1, bn, evp, ocsp, pem, pkcs7, pkcs12, rsa, > ssl (in > > >>>> addition > > >>>> to cms, dsa, srp, which are disabled in edk2) will call rand_* interface as > well. > > >>>> > > >> > > >> If we have both internal (to Openssl) and external users of the RNG > > >> api, then I guess there is no way to work around this. It is > > >> unfortunate, since the RNG code in OpenSSL doesn't actually use double > > >> types except for keeping an entropy count, which could just as easily > > >> be kept in an integer variable. > > > > (1) I think I agree... However, it seems that the first function (or one > > of the first functions) in OpenSSL to take an "entropy" parameter, of > > type "double", was RAND_add(). And the RAND_add() manual states, > > > > RAND_add() mixes the num bytes at buf into the PRNG state. > > Thus, if the data at buf are unpredictable to an adversary, > > this increases the uncertainty about the state and makes the > > PRNG output less predictable. Suitable input comes from user > > interaction (random key presses, mouse movements) and certain > > hardware events. The entropy argument is (the lower bound of) > > an estimate of how much randomness is contained in buf, > > measured in bytes. Details about sources of randomness and how > > to estimate their entropy can be found in the literature, e.g. > > RFC 1750. > > > > I've now looked up RFC 1750, and it contains copious amounts of math on > > irrational numbers. Hence the use of floating point in OpenSSL, I'd guess. > > > > https://www.ietf.org/rfc/rfc1750.txt > > > > ... After digging a bit in the OpenSSL git history, I've found the > > following commit (from 19 years ago): > > > > commit 853f757ecea74a271a7c5cdee3f3b5fe0d3ae863 > > Author: Bodo Möller <bodo@openssl.org> > > Date: Sat Feb 19 15:22:53 2000 +0000 > > > > Allow for higher granularity of entropy estimates by using 'double' > > instead of 'unsigned' counters. > > Seed PRNG in MacOS/GetHTTPS.src/GetHTTPS.cpp. > > > > Partially submitted by Yoram Meroz <yoram@mail.idrive.com>. > > > > It was the commit with > > > > -void RAND_add(const void *buf,int num,int entropy); > > +void RAND_add(const void *buf,int num,double entropy); > > > > FWIW, the "PRNG" reference at the end of the commit message seems > > meaningless. Check for yourself: > > > > $ git show 853f757ecea7:MacOS/GetHTTPS.src/GetHTTPS.cpp > > > > The fact that "entropy" is now of type "double" does not seem to be put > > to use, anywhere in that file. > > > > I'll send a query to the openssl-users mailing list, just so we > > understand better. > > > > Thanks for doing the paleontological research here. > > However, the outcome of this query is not going to affect our short > term issue with this code. > > I will try to come back to this issue as soon as I can, but I am a bit > swamped at the moment. > > The community has decided to complete the upgrade for edk2-stable201905. How long will you need to add those two APIs? Regards, Jian > > > > > > >> So we will need to fix ArmSoftFloatLib before we can merge this > > >> OpenSSL update. > > > > (2) NB, I think we can no longer merge this feature for > > edk2-stable201905. The soft feature freeze criterion is that all patches > > be reviewed (approved) on-list before the SFF date / announcement, and > > that was not fulfilled in this case. > > > > > > >> I'm happy to help doing that, could you please > > >> summarize what we are missing today? > > >> > > > > > > Great. I think there're two intrinsic functions missing here > > > > > > __aeabi_ui2d > > > __aeabi_d2uiz > > > > > > Laszlo, please double check if these two are enough. > > > > (3) I can only report the failure that trips up the build for me. I did > > that here: > > > > http://mid.mail-archive.com/049e489c-b58f-0fc5-1c66- > 8ad920d93979@redhat.com > > https://edk2.groups.io/g/devel/message/40823 > > > > > > Thus, for me, the missing symbol was "__aeabi_ui2d". > > > > It's possible that the 32-bit ARM build will fail at a different (later) > > stage as well, but I can't tell until I get past this one. (And I don't > > think I can implement a "shim" function for the missing symbol, just to > > let the build progress.) > > > > Thanks, > > Laszlo > > > > > Thanks for doing this. > > > > > > Regards, > > > Jian > > > > > >> > > > > > > > ^ permalink raw reply [flat|nested] 39+ messages in thread
* Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b 2019-05-16 18:25 ` [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b Laszlo Ersek 2019-05-17 5:11 ` Wang, Jian J @ 2019-05-17 10:12 ` Xiaoyu Lu 2019-05-17 13:08 ` Laszlo Ersek 1 sibling, 1 reply; 39+ messages in thread From: Xiaoyu Lu @ 2019-05-17 10:12 UTC (permalink / raw) To: devel@edk2.groups.io, lersek@redhat.com Cc: Wang, Jian J, Ye, Ting, Ard Biesheuvel, Leif Lindholm Hi, Lerszlo: (1): > Unfortunately, I've found another build issue with this series. (My apologies that I didn't discover it earlier.) It is reported in the 32-bit (ARM) build of the ArmVirtQemu platform: > > CryptoPkg/Library/OpensslLib/openssl/crypto/rand/drbg_lib.c:1028: > undefined reference to `__aeabi_ui2d' > OpensslLib[Crypto].inf contains ArmSoftFloatLib as dependent library. In ArmSoftFloatLib: softfloat-for-gcc.h|98| #define uint32_to_float64 __floatunsidf softfloat-for-gcc.h|222| #define __floatunsidf __aeabi_ui2d softfloat-for-gcc.h|128| #define float64_to_uint32_round_to_zero __fixunsdfsi softfloat-for-gcc.h|234| #define __fixunsdfsi __aeabi_d2uiz But *uint32_to_float64* and *float64_to_uint32_round_to_zero* aren't implemented in softfloat.c If these two functions implement, the build will pass. (I use dummy functions and try) (2): >thus, preferably, a CryptoPkg patch series should be at least build tested (if not boot tested) for all arches, before being posted to the mailing list. I should test ARM, since IA32 arch has Intrinsic problem(_ftol2). It is very likely that ARM arch does not support it either. >(Yes, CI would help a lot with such issues.) Now I don't have a CI environment here. I will setup one for building OvmfPkg, ArmVirtPkg, EmulatorPkg. Thanks, Xiaoyu -----Original Message----- From: devel@edk2.groups.io [mailto:devel@edk2.groups.io] On Behalf Of Laszlo Ersek Sent: Friday, May 17, 2019 2:26 AM To: devel@edk2.groups.io; Lu, XiaoyuX <xiaoyux.lu@intel.com> Cc: Wang, Jian J <jian.j.wang@intel.com>; Ye, Ting <ting.ye@intel.com>; Ard Biesheuvel <ard.biesheuvel@linaro.org>; Leif Lindholm <leif.lindholm@linaro.org> Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b Hi, (+ Ard and Leif) On 05/16/19 09:54, Xiaoyu lu wrote: > This series is also available at: > https://github.com/xiaoyuxlu/edk2/tree/bz_1089_upgrade_to_openssl_1_1_ > 1b_v4 > > Changes: > > (1) CryptoPkgOpensslLib: Modify process_files.pl for upgrading > OpenSSL > > (2) CryptoPkg/OpensslLib: Exclude unnecessary files in process_files.pl > crypto/store/* are excluded. > crypto/rand/randfile.c is excluded. > > (3) CryptoPkg/IntrinsicLib: Fix possible unresolved external symbol > issue > > (4) CryptoPkg/OpensslLib: Prepare for upgrading OpenSSL > Disable warnings for buiding OpenSSL_1_1_1b > > (5) CryptoPkg/OpensslLib: Fix cross-build problem for AARCH64 > > (6) CryptoPkg: Upgrade OpenSSL to 1.1.1b > The biggest change is use TSC as entropy source > If TSC isn't avaiable, fallback to TimerLib(PerformanceCounter). > > (7) CryptoPkg/BaseCryptLib: Make HMAC_CTX size backward compatible > > > Verification done for this series: > * Https boot in OvmfPkg. > * BaseCrypt Library test. (Ovmf, EmulatorPkg) > > Important notice: > Nt32Pkg doesn't support TimerLib >> TimerLib|MdePkg/Library/BaseTimerLibNullTemplate/BaseTimerLibNullTemp >> TimerLib|late.inf > So it will failed in Nt32Pkg. > > Cc: Jian J Wang <jian.j.wang@intel.com> > Cc: Ting Ye <ting.ye@intel.com> > > Laszlo Ersek (1): > CryptoPkg/OpensslLib: Fix cross-build problem for AARCH64 > > Xiaoyu Lu (6): > CryptoPkg/OpensslLib: Modify process_files.pl for upgrading OpenSSL > CryptoPkg/OpensslLib: Exclude unnecessary files in process_files.pl > CryptoPkg/IntrinsicLib: Fix possible unresolved external symbol issue > CryptoPkg/OpensslLib: Prepare for upgrading OpenSSL > CryptoPkg: Upgrade OpenSSL to 1.1.1b > CryptoPkg/BaseCryptLib: Make HMAC_CTX size backward compatible > > CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf | 4 +- > CryptoPkg/Library/OpensslLib/OpensslLib.inf | 76 ++++- > CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 67 ++++- > CryptoPkg/Library/Include/CrtLibSupport.h | 13 +- > CryptoPkg/Library/Include/openssl/opensslconf.h | 54 +++- > CryptoPkg/Library/Include/sys/syscall.h | 11 + > CryptoPkg/Library/OpensslLib/buildinf.h | 2 + > CryptoPkg/Library/OpensslLib/rand_pool_noise.h | 29 ++ > CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacMd5.c | 8 +- > .../Library/BaseCryptLib/Hmac/CryptHmacSha1.c | 9 +- > .../Library/BaseCryptLib/Hmac/CryptHmacSha256.c | 8 +- > CryptoPkg/Library/IntrinsicLib/Ia32/MathFtol.c | 22 ++ > CryptoPkg/Library/OpensslLib/ossl_store.c | 17 ++ > CryptoPkg/Library/OpensslLib/rand_pool.c | 316 +++++++++++++++++++++ > CryptoPkg/Library/OpensslLib/rand_pool_noise.c | 29 ++ > CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c | 43 +++ > CryptoPkg/Library/OpensslLib/openssl | 2 +- > CryptoPkg/Library/OpensslLib/process_files.pl | 11 +- > 18 files changed, 669 insertions(+), 52 deletions(-) create mode > 100644 CryptoPkg/Library/Include/sys/syscall.h > create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.h > create mode 100644 CryptoPkg/Library/IntrinsicLib/Ia32/MathFtol.c > create mode 100644 CryptoPkg/Library/OpensslLib/ossl_store.c > create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool.c > create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.c > create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c > Unfortunately, I've found another build issue with this series. (My apologies that I didn't discover it earlier.) It is reported in the 32-bit (ARM) build of the ArmVirtQemu platform: CryptoPkg/Library/OpensslLib/openssl/crypto/rand/drbg_lib.c:1028: undefined reference to `__aeabi_ui2d' The referenced line is from the drbg_add() function: if (buflen < seedlen || randomness < (double) seedlen) { Beyond the failure to resolve the "__aeabi_ui2d" symbol, the edk2 coding style spec says, "Floating point operations are not recommended in UEFI firmware." (Even though the UEFI spec describes the required floating point environment for all architectures.) So, I'm not sure what we should do here. If we think that floating point is plain evil in edk2, then we cannot rebase edk2 to OpenSSL-1.1.1b. ... Hmmm, this seems to be the 32-bit ARM variant of [PATCH v4 3/7]! If we find floating point generally acceptable in edk2, then Ard and Leif could help us decide please whether this 32-bit ARM issue should be fixed during the feature freeze (when fixes are still allowed), or if it justifies postponing OpenSSL 1.1.1b to the next edk2 stable tag. Again, I'm sorry that I found this only now -- but "CryptoPkg/CryptoPkg.dsc" is multi-arch: SUPPORTED_ARCHITECTURES = IA32|X64|ARM|AARCH64 thus, preferably, a CryptoPkg patch series should be at least build tested (if not boot tested) for all arches, before being posted to the mailing list. (Yes, CI would help a lot with such issues.) Thanks Laszlo ^ permalink raw reply [flat|nested] 39+ messages in thread
* Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b 2019-05-17 10:12 ` Xiaoyu Lu @ 2019-05-17 13:08 ` Laszlo Ersek 2019-05-18 7:37 ` Xiaoyu Lu 0 siblings, 1 reply; 39+ messages in thread From: Laszlo Ersek @ 2019-05-17 13:08 UTC (permalink / raw) To: Lu, XiaoyuX, devel@edk2.groups.io Cc: Wang, Jian J, Ye, Ting, Ard Biesheuvel, Leif Lindholm On 05/17/19 12:12, Lu, XiaoyuX wrote: > Hi, Lerszlo: well... I agree that my first name may not be trivial to spell, but you can always use the clipboard, whenever in doubt. For the record, it's "Laszlo". > > (1): > >> Unfortunately, I've found another build issue with this series. (My apologies that I didn't discover it earlier.) It is reported in the 32-bit (ARM) build of the ArmVirtQemu platform: >> >> CryptoPkg/Library/OpensslLib/openssl/crypto/rand/drbg_lib.c:1028: >> undefined reference to `__aeabi_ui2d' >> > > OpensslLib[Crypto].inf contains ArmSoftFloatLib as dependent library. > > In ArmSoftFloatLib: > > softfloat-for-gcc.h|98| #define uint32_to_float64 __floatunsidf > softfloat-for-gcc.h|222| #define __floatunsidf __aeabi_ui2d > > softfloat-for-gcc.h|128| #define float64_to_uint32_round_to_zero __fixunsdfsi > softfloat-for-gcc.h|234| #define __fixunsdfsi __aeabi_d2uiz > > But *uint32_to_float64* and *float64_to_uint32_round_to_zero* aren't implemented in softfloat.c > > If these two functions implement, the build will pass. (I use dummy functions and try) See my response to Jian on this. > (2): > >> thus, preferably, a CryptoPkg patch series should be at least build tested (if not boot tested) for all arches, before being posted to the mailing list. > > I should test ARM, since IA32 arch has Intrinsic problem(_ftol2). It is very likely that ARM arch does not support it either. > >> (Yes, CI would help a lot with such issues.) > > Now I don't have a CI environment here. > I will setup one for building OvmfPkg, ArmVirtPkg, EmulatorPkg. Sorry, I was unclear: I meant a community-level, central CI. Not a personal one. And, the central CI is undergoing design discussions right now. Thanks Laszlo > -----Original Message----- > From: devel@edk2.groups.io [mailto:devel@edk2.groups.io] On Behalf Of Laszlo Ersek > Sent: Friday, May 17, 2019 2:26 AM > To: devel@edk2.groups.io; Lu, XiaoyuX <xiaoyux.lu@intel.com> > Cc: Wang, Jian J <jian.j.wang@intel.com>; Ye, Ting <ting.ye@intel.com>; Ard Biesheuvel <ard.biesheuvel@linaro.org>; Leif Lindholm <leif.lindholm@linaro.org> > Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b > > Hi, > > (+ Ard and Leif) > > On 05/16/19 09:54, Xiaoyu lu wrote: >> This series is also available at: >> https://github.com/xiaoyuxlu/edk2/tree/bz_1089_upgrade_to_openssl_1_1_ >> 1b_v4 >> >> Changes: >> >> (1) CryptoPkgOpensslLib: Modify process_files.pl for upgrading >> OpenSSL >> >> (2) CryptoPkg/OpensslLib: Exclude unnecessary files in process_files.pl >> crypto/store/* are excluded. >> crypto/rand/randfile.c is excluded. >> >> (3) CryptoPkg/IntrinsicLib: Fix possible unresolved external symbol >> issue >> >> (4) CryptoPkg/OpensslLib: Prepare for upgrading OpenSSL >> Disable warnings for buiding OpenSSL_1_1_1b >> >> (5) CryptoPkg/OpensslLib: Fix cross-build problem for AARCH64 >> >> (6) CryptoPkg: Upgrade OpenSSL to 1.1.1b >> The biggest change is use TSC as entropy source >> If TSC isn't avaiable, fallback to TimerLib(PerformanceCounter). >> >> (7) CryptoPkg/BaseCryptLib: Make HMAC_CTX size backward compatible >> >> >> Verification done for this series: >> * Https boot in OvmfPkg. >> * BaseCrypt Library test. (Ovmf, EmulatorPkg) >> >> Important notice: >> Nt32Pkg doesn't support TimerLib >>> TimerLib|MdePkg/Library/BaseTimerLibNullTemplate/BaseTimerLibNullTemp >>> TimerLib|late.inf >> So it will failed in Nt32Pkg. >> >> Cc: Jian J Wang <jian.j.wang@intel.com> >> Cc: Ting Ye <ting.ye@intel.com> >> >> Laszlo Ersek (1): >> CryptoPkg/OpensslLib: Fix cross-build problem for AARCH64 >> >> Xiaoyu Lu (6): >> CryptoPkg/OpensslLib: Modify process_files.pl for upgrading OpenSSL >> CryptoPkg/OpensslLib: Exclude unnecessary files in process_files.pl >> CryptoPkg/IntrinsicLib: Fix possible unresolved external symbol issue >> CryptoPkg/OpensslLib: Prepare for upgrading OpenSSL >> CryptoPkg: Upgrade OpenSSL to 1.1.1b >> CryptoPkg/BaseCryptLib: Make HMAC_CTX size backward compatible >> >> CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf | 4 +- >> CryptoPkg/Library/OpensslLib/OpensslLib.inf | 76 ++++- >> CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 67 ++++- >> CryptoPkg/Library/Include/CrtLibSupport.h | 13 +- >> CryptoPkg/Library/Include/openssl/opensslconf.h | 54 +++- >> CryptoPkg/Library/Include/sys/syscall.h | 11 + >> CryptoPkg/Library/OpensslLib/buildinf.h | 2 + >> CryptoPkg/Library/OpensslLib/rand_pool_noise.h | 29 ++ >> CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacMd5.c | 8 +- >> .../Library/BaseCryptLib/Hmac/CryptHmacSha1.c | 9 +- >> .../Library/BaseCryptLib/Hmac/CryptHmacSha256.c | 8 +- >> CryptoPkg/Library/IntrinsicLib/Ia32/MathFtol.c | 22 ++ >> CryptoPkg/Library/OpensslLib/ossl_store.c | 17 ++ >> CryptoPkg/Library/OpensslLib/rand_pool.c | 316 +++++++++++++++++++++ >> CryptoPkg/Library/OpensslLib/rand_pool_noise.c | 29 ++ >> CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c | 43 +++ >> CryptoPkg/Library/OpensslLib/openssl | 2 +- >> CryptoPkg/Library/OpensslLib/process_files.pl | 11 +- >> 18 files changed, 669 insertions(+), 52 deletions(-) create mode >> 100644 CryptoPkg/Library/Include/sys/syscall.h >> create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.h >> create mode 100644 CryptoPkg/Library/IntrinsicLib/Ia32/MathFtol.c >> create mode 100644 CryptoPkg/Library/OpensslLib/ossl_store.c >> create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool.c >> create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.c >> create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c >> > > Unfortunately, I've found another build issue with this series. (My apologies that I didn't discover it earlier.) It is reported in the 32-bit (ARM) build of the ArmVirtQemu platform: > > CryptoPkg/Library/OpensslLib/openssl/crypto/rand/drbg_lib.c:1028: > undefined reference to `__aeabi_ui2d' > > The referenced line is from the drbg_add() function: > > if (buflen < seedlen || randomness < (double) seedlen) { > > Beyond the failure to resolve the "__aeabi_ui2d" symbol, the edk2 coding style spec says, "Floating point operations are not recommended in UEFI firmware." (Even though the UEFI spec describes the required floating point environment for all architectures.) > > So, I'm not sure what we should do here. If we think that floating point is plain evil in edk2, then we cannot rebase edk2 to OpenSSL-1.1.1b. > > ... Hmmm, this seems to be the 32-bit ARM variant of [PATCH v4 3/7]! > > If we find floating point generally acceptable in edk2, then Ard and Leif could help us decide please whether this 32-bit ARM issue should be fixed during the feature freeze (when fixes are still allowed), or if it justifies postponing OpenSSL 1.1.1b to the next edk2 stable tag. > > Again, I'm sorry that I found this only now -- but "CryptoPkg/CryptoPkg.dsc" is multi-arch: > > SUPPORTED_ARCHITECTURES = IA32|X64|ARM|AARCH64 > > thus, preferably, a CryptoPkg patch series should be at least build tested (if not boot tested) for all arches, before being posted to the mailing list. > > (Yes, CI would help a lot with such issues.) > > Thanks > Laszlo > > > ^ permalink raw reply [flat|nested] 39+ messages in thread
* Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b 2019-05-17 13:08 ` Laszlo Ersek @ 2019-05-18 7:37 ` Xiaoyu Lu 0 siblings, 0 replies; 39+ messages in thread From: Xiaoyu Lu @ 2019-05-18 7:37 UTC (permalink / raw) To: devel@edk2.groups.io, lersek@redhat.com Cc: Wang, Jian J, Ye, Ting, Ard Biesheuvel, Leif Lindholm Laszlo, I'm so sorry that I made a mistake about your name. Thanks Xiaoyu -----Original Message----- From: devel@edk2.groups.io [mailto:devel@edk2.groups.io] On Behalf Of Laszlo Ersek Sent: Friday, May 17, 2019 9:08 PM To: Lu, XiaoyuX <xiaoyux.lu@intel.com>; devel@edk2.groups.io Cc: Wang, Jian J <jian.j.wang@intel.com>; Ye, Ting <ting.ye@intel.com>; Ard Biesheuvel <ard.biesheuvel@linaro.org>; Leif Lindholm <leif.lindholm@linaro.org> Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b On 05/17/19 12:12, Lu, XiaoyuX wrote: > Hi, Lerszlo: well... I agree that my first name may not be trivial to spell, but you can always use the clipboard, whenever in doubt. For the record, it's "Laszlo". > > (1): > >> Unfortunately, I've found another build issue with this series. (My apologies that I didn't discover it earlier.) It is reported in the 32-bit (ARM) build of the ArmVirtQemu platform: >> >> CryptoPkg/Library/OpensslLib/openssl/crypto/rand/drbg_lib.c:1028: >> undefined reference to `__aeabi_ui2d' >> > > OpensslLib[Crypto].inf contains ArmSoftFloatLib as dependent library. > > In ArmSoftFloatLib: > > softfloat-for-gcc.h|98| #define uint32_to_float64 __floatunsidf > softfloat-for-gcc.h|222| #define __floatunsidf __aeabi_ui2d > > softfloat-for-gcc.h|128| #define float64_to_uint32_round_to_zero __fixunsdfsi > softfloat-for-gcc.h|234| #define __fixunsdfsi __aeabi_d2uiz > > But *uint32_to_float64* and *float64_to_uint32_round_to_zero* aren't > implemented in softfloat.c > > If these two functions implement, the build will pass. (I use dummy > functions and try) See my response to Jian on this. > (2): > >> thus, preferably, a CryptoPkg patch series should be at least build tested (if not boot tested) for all arches, before being posted to the mailing list. > > I should test ARM, since IA32 arch has Intrinsic problem(_ftol2). It is very likely that ARM arch does not support it either. > >> (Yes, CI would help a lot with such issues.) > > Now I don't have a CI environment here. > I will setup one for building OvmfPkg, ArmVirtPkg, EmulatorPkg. Sorry, I was unclear: I meant a community-level, central CI. Not a personal one. And, the central CI is undergoing design discussions right now. Thanks Laszlo > -----Original Message----- > From: devel@edk2.groups.io [mailto:devel@edk2.groups.io] On Behalf Of > Laszlo Ersek > Sent: Friday, May 17, 2019 2:26 AM > To: devel@edk2.groups.io; Lu, XiaoyuX <xiaoyux.lu@intel.com> > Cc: Wang, Jian J <jian.j.wang@intel.com>; Ye, Ting > <ting.ye@intel.com>; Ard Biesheuvel <ard.biesheuvel@linaro.org>; Leif > Lindholm <leif.lindholm@linaro.org> > Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to > 1.1.1b > > Hi, > > (+ Ard and Leif) > > On 05/16/19 09:54, Xiaoyu lu wrote: >> This series is also available at: >> https://github.com/xiaoyuxlu/edk2/tree/bz_1089_upgrade_to_openssl_1_1 >> _ >> 1b_v4 >> >> Changes: >> >> (1) CryptoPkgOpensslLib: Modify process_files.pl for upgrading >> OpenSSL >> >> (2) CryptoPkg/OpensslLib: Exclude unnecessary files in process_files.pl >> crypto/store/* are excluded. >> crypto/rand/randfile.c is excluded. >> >> (3) CryptoPkg/IntrinsicLib: Fix possible unresolved external symbol >> issue >> >> (4) CryptoPkg/OpensslLib: Prepare for upgrading OpenSSL >> Disable warnings for buiding OpenSSL_1_1_1b >> >> (5) CryptoPkg/OpensslLib: Fix cross-build problem for AARCH64 >> >> (6) CryptoPkg: Upgrade OpenSSL to 1.1.1b >> The biggest change is use TSC as entropy source >> If TSC isn't avaiable, fallback to TimerLib(PerformanceCounter). >> >> (7) CryptoPkg/BaseCryptLib: Make HMAC_CTX size backward compatible >> >> >> Verification done for this series: >> * Https boot in OvmfPkg. >> * BaseCrypt Library test. (Ovmf, EmulatorPkg) >> >> Important notice: >> Nt32Pkg doesn't support TimerLib >>> TimerLib|MdePkg/Library/BaseTimerLibNullTemplate/BaseTimerLibNullTem >>> TimerLib|p >>> TimerLib|late.inf >> So it will failed in Nt32Pkg. >> >> Cc: Jian J Wang <jian.j.wang@intel.com> >> Cc: Ting Ye <ting.ye@intel.com> >> >> Laszlo Ersek (1): >> CryptoPkg/OpensslLib: Fix cross-build problem for AARCH64 >> >> Xiaoyu Lu (6): >> CryptoPkg/OpensslLib: Modify process_files.pl for upgrading OpenSSL >> CryptoPkg/OpensslLib: Exclude unnecessary files in process_files.pl >> CryptoPkg/IntrinsicLib: Fix possible unresolved external symbol issue >> CryptoPkg/OpensslLib: Prepare for upgrading OpenSSL >> CryptoPkg: Upgrade OpenSSL to 1.1.1b >> CryptoPkg/BaseCryptLib: Make HMAC_CTX size backward compatible >> >> CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf | 4 +- >> CryptoPkg/Library/OpensslLib/OpensslLib.inf | 76 ++++- >> CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 67 ++++- >> CryptoPkg/Library/Include/CrtLibSupport.h | 13 +- >> CryptoPkg/Library/Include/openssl/opensslconf.h | 54 +++- >> CryptoPkg/Library/Include/sys/syscall.h | 11 + >> CryptoPkg/Library/OpensslLib/buildinf.h | 2 + >> CryptoPkg/Library/OpensslLib/rand_pool_noise.h | 29 ++ >> CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacMd5.c | 8 +- >> .../Library/BaseCryptLib/Hmac/CryptHmacSha1.c | 9 +- >> .../Library/BaseCryptLib/Hmac/CryptHmacSha256.c | 8 +- >> CryptoPkg/Library/IntrinsicLib/Ia32/MathFtol.c | 22 ++ >> CryptoPkg/Library/OpensslLib/ossl_store.c | 17 ++ >> CryptoPkg/Library/OpensslLib/rand_pool.c | 316 +++++++++++++++++++++ >> CryptoPkg/Library/OpensslLib/rand_pool_noise.c | 29 ++ >> CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c | 43 +++ >> CryptoPkg/Library/OpensslLib/openssl | 2 +- >> CryptoPkg/Library/OpensslLib/process_files.pl | 11 +- >> 18 files changed, 669 insertions(+), 52 deletions(-) create mode >> 100644 CryptoPkg/Library/Include/sys/syscall.h >> create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.h >> create mode 100644 CryptoPkg/Library/IntrinsicLib/Ia32/MathFtol.c >> create mode 100644 CryptoPkg/Library/OpensslLib/ossl_store.c >> create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool.c >> create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.c >> create mode 100644 >> CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c >> > > Unfortunately, I've found another build issue with this series. (My apologies that I didn't discover it earlier.) It is reported in the 32-bit (ARM) build of the ArmVirtQemu platform: > > CryptoPkg/Library/OpensslLib/openssl/crypto/rand/drbg_lib.c:1028: > undefined reference to `__aeabi_ui2d' > > The referenced line is from the drbg_add() function: > > if (buflen < seedlen || randomness < (double) seedlen) { > > Beyond the failure to resolve the "__aeabi_ui2d" symbol, the edk2 > coding style spec says, "Floating point operations are not recommended > in UEFI firmware." (Even though the UEFI spec describes the required > floating point environment for all architectures.) > > So, I'm not sure what we should do here. If we think that floating point is plain evil in edk2, then we cannot rebase edk2 to OpenSSL-1.1.1b. > > ... Hmmm, this seems to be the 32-bit ARM variant of [PATCH v4 3/7]! > > If we find floating point generally acceptable in edk2, then Ard and Leif could help us decide please whether this 32-bit ARM issue should be fixed during the feature freeze (when fixes are still allowed), or if it justifies postponing OpenSSL 1.1.1b to the next edk2 stable tag. > > Again, I'm sorry that I found this only now -- but "CryptoPkg/CryptoPkg.dsc" is multi-arch: > > SUPPORTED_ARCHITECTURES = IA32|X64|ARM|AARCH64 > > thus, preferably, a CryptoPkg patch series should be at least build tested (if not boot tested) for all arches, before being posted to the mailing list. > > (Yes, CI would help a lot with such issues.) > > Thanks > Laszlo > > > ^ permalink raw reply [flat|nested] 39+ messages in thread
* Re: [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b 2019-05-16 7:54 [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b Xiaoyu lu ` (7 preceding siblings ...) 2019-05-16 18:25 ` [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b Laszlo Ersek @ 2019-05-16 18:53 ` Laszlo Ersek 2019-05-17 5:00 ` [edk2-devel] " Wang, Jian J 2019-05-17 9:17 ` Gary Lin 2019-05-21 21:14 ` Laszlo Ersek 10 siblings, 1 reply; 39+ messages in thread From: Laszlo Ersek @ 2019-05-16 18:53 UTC (permalink / raw) To: Xiaoyu Lu, devel; +Cc: Jian J Wang, Ting Ye On 05/16/19 09:54, Xiaoyu Lu wrote: > This series is also available at: > https://github.com/xiaoyuxlu/edk2/tree/bz_1089_upgrade_to_openssl_1_1_1b_v4 > > Changes: > > (1) CryptoPkgOpensslLib: Modify process_files.pl for upgrading OpenSSL > > (2) CryptoPkg/OpensslLib: Exclude unnecessary files in process_files.pl > crypto/store/* are excluded. > crypto/rand/randfile.c is excluded. > > (3) CryptoPkg/IntrinsicLib: Fix possible unresolved external symbol issue > > (4) CryptoPkg/OpensslLib: Prepare for upgrading OpenSSL > Disable warnings for buiding OpenSSL_1_1_1b > > (5) CryptoPkg/OpensslLib: Fix cross-build problem for AARCH64 > > (6) CryptoPkg: Upgrade OpenSSL to 1.1.1b > The biggest change is use TSC as entropy source > If TSC isn't avaiable, fallback to TimerLib(PerformanceCounter). > > (7) CryptoPkg/BaseCryptLib: Make HMAC_CTX size backward compatible > > > Verification done for this series: > * Https boot in OvmfPkg. > * BaseCrypt Library test. (Ovmf, EmulatorPkg) > > Important notice: > Nt32Pkg doesn't support TimerLib >> TimerLib|MdePkg/Library/BaseTimerLibNullTemplate/BaseTimerLibNullTemplate.inf > So it will failed in Nt32Pkg. I did some minimal functional testing, as follows: - built OvmfPkgIa32X64.dsc with -D SMM_REQUIRE -D SECURE_BOOT_ENABLE - with SB pre-enabled in an existing VM, the firmware continued to reject an unsigned UEFI app - in the same config, the firmware continued to accept a correctly signed UEFI boot loader (the Fedora OS was booted OK) - with SB disabled afresh (deleting PK through SecureBootConfigDxe), both of the above binaries were accepted - in the same SB-disabled state, OvmfPkg/EnrollDefaultKeys was possible to invoke from the UEFI shell, and it successfully re-enabled SB (with the effects described in the prior section). So this part looks good. Thanks Laszlo ^ permalink raw reply [flat|nested] 39+ messages in thread
* Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b 2019-05-16 18:53 ` Laszlo Ersek @ 2019-05-17 5:00 ` Wang, Jian J 0 siblings, 0 replies; 39+ messages in thread From: Wang, Jian J @ 2019-05-17 5:00 UTC (permalink / raw) To: devel@edk2.groups.io, lersek@redhat.com, Lu, XiaoyuX; +Cc: Ye, Ting Laszlo, Thanks for the test. Regards, Jian > -----Original Message----- > From: devel@edk2.groups.io [mailto:devel@edk2.groups.io] On Behalf Of > Laszlo Ersek > Sent: Friday, May 17, 2019 2:53 AM > To: Lu, XiaoyuX <xiaoyux.lu@intel.com>; devel@edk2.groups.io > Cc: Wang, Jian J <jian.j.wang@intel.com>; Ye, Ting <ting.ye@intel.com> > Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b > > On 05/16/19 09:54, Xiaoyu Lu wrote: > > This series is also available at: > > > https://github.com/xiaoyuxlu/edk2/tree/bz_1089_upgrade_to_openssl_1_1_1b > _v4 > > > > Changes: > > > > (1) CryptoPkgOpensslLib: Modify process_files.pl for upgrading OpenSSL > > > > (2) CryptoPkg/OpensslLib: Exclude unnecessary files in process_files.pl > > crypto/store/* are excluded. > > crypto/rand/randfile.c is excluded. > > > > (3) CryptoPkg/IntrinsicLib: Fix possible unresolved external symbol issue > > > > (4) CryptoPkg/OpensslLib: Prepare for upgrading OpenSSL > > Disable warnings for buiding OpenSSL_1_1_1b > > > > (5) CryptoPkg/OpensslLib: Fix cross-build problem for AARCH64 > > > > (6) CryptoPkg: Upgrade OpenSSL to 1.1.1b > > The biggest change is use TSC as entropy source > > If TSC isn't avaiable, fallback to TimerLib(PerformanceCounter). > > > > (7) CryptoPkg/BaseCryptLib: Make HMAC_CTX size backward compatible > > > > > > Verification done for this series: > > * Https boot in OvmfPkg. > > * BaseCrypt Library test. (Ovmf, EmulatorPkg) > > > > Important notice: > > Nt32Pkg doesn't support TimerLib > >> > TimerLib|MdePkg/Library/BaseTimerLibNullTemplate/BaseTimerLibNullTemplat > e.inf > > So it will failed in Nt32Pkg. > > I did some minimal functional testing, as follows: > > - built OvmfPkgIa32X64.dsc with -D SMM_REQUIRE -D SECURE_BOOT_ENABLE > > - with SB pre-enabled in an existing VM, the firmware continued to > reject an unsigned UEFI app > - in the same config, the firmware continued to accept a correctly > signed UEFI boot loader (the Fedora OS was booted OK) > > - with SB disabled afresh (deleting PK through SecureBootConfigDxe), > both of the above binaries were accepted > - in the same SB-disabled state, OvmfPkg/EnrollDefaultKeys was possible > to invoke from the UEFI shell, and it successfully re-enabled SB (with > the effects described in the prior section). > > So this part looks good. > > Thanks > Laszlo > > ^ permalink raw reply [flat|nested] 39+ messages in thread
* Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b 2019-05-16 7:54 [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b Xiaoyu lu ` (8 preceding siblings ...) 2019-05-16 18:53 ` Laszlo Ersek @ 2019-05-17 9:17 ` Gary Lin 2019-05-18 7:26 ` Xiaoyu Lu 2019-05-21 21:14 ` Laszlo Ersek 10 siblings, 1 reply; 39+ messages in thread From: Gary Lin @ 2019-05-17 9:17 UTC (permalink / raw) To: devel, xiaoyux.lu; +Cc: Laszlo Ersek, Jian J Wang, Ting Ye On Thu, May 16, 2019 at 03:54:51AM -0400, Xiaoyu lu wrote: > This series is also available at: > https://github.com/xiaoyuxlu/edk2/tree/bz_1089_upgrade_to_openssl_1_1_1b_v4 > > Changes: > > (1) CryptoPkgOpensslLib: Modify process_files.pl for upgrading OpenSSL > > (2) CryptoPkg/OpensslLib: Exclude unnecessary files in process_files.pl > crypto/store/* are excluded. > crypto/rand/randfile.c is excluded. > > (3) CryptoPkg/IntrinsicLib: Fix possible unresolved external symbol issue > > (4) CryptoPkg/OpensslLib: Prepare for upgrading OpenSSL > Disable warnings for buiding OpenSSL_1_1_1b > > (5) CryptoPkg/OpensslLib: Fix cross-build problem for AARCH64 > > (6) CryptoPkg: Upgrade OpenSSL to 1.1.1b > The biggest change is use TSC as entropy source > If TSC isn't avaiable, fallback to TimerLib(PerformanceCounter). > > (7) CryptoPkg/BaseCryptLib: Make HMAC_CTX size backward compatible > > > Verification done for this series: > * Https boot in OvmfPkg. > * BaseCrypt Library test. (Ovmf, EmulatorPkg) > My https boot test with ovmf looks good. The connection was rejected as expected when the server certificate wasn't enrolled. The bootloader images were downloaded after adding the certificate, and I can boot into the installation UI in the end. I skipped the test for aavmf since TLS is still not enabled. For the series. Tested-by: Gary Lin <glin@suse.com> > Important notice: > Nt32Pkg doesn't support TimerLib > > TimerLib|MdePkg/Library/BaseTimerLibNullTemplate/BaseTimerLibNullTemplate.inf > So it will failed in Nt32Pkg. > > Cc: Jian J Wang <jian.j.wang@intel.com> > Cc: Ting Ye <ting.ye@intel.com> > > Laszlo Ersek (1): > CryptoPkg/OpensslLib: Fix cross-build problem for AARCH64 > > Xiaoyu Lu (6): > CryptoPkg/OpensslLib: Modify process_files.pl for upgrading OpenSSL > CryptoPkg/OpensslLib: Exclude unnecessary files in process_files.pl > CryptoPkg/IntrinsicLib: Fix possible unresolved external symbol issue > CryptoPkg/OpensslLib: Prepare for upgrading OpenSSL > CryptoPkg: Upgrade OpenSSL to 1.1.1b > CryptoPkg/BaseCryptLib: Make HMAC_CTX size backward compatible > > CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf | 4 +- > CryptoPkg/Library/OpensslLib/OpensslLib.inf | 76 ++++- > CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 67 ++++- > CryptoPkg/Library/Include/CrtLibSupport.h | 13 +- > CryptoPkg/Library/Include/openssl/opensslconf.h | 54 +++- > CryptoPkg/Library/Include/sys/syscall.h | 11 + > CryptoPkg/Library/OpensslLib/buildinf.h | 2 + > CryptoPkg/Library/OpensslLib/rand_pool_noise.h | 29 ++ > CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacMd5.c | 8 +- > .../Library/BaseCryptLib/Hmac/CryptHmacSha1.c | 9 +- > .../Library/BaseCryptLib/Hmac/CryptHmacSha256.c | 8 +- > CryptoPkg/Library/IntrinsicLib/Ia32/MathFtol.c | 22 ++ > CryptoPkg/Library/OpensslLib/ossl_store.c | 17 ++ > CryptoPkg/Library/OpensslLib/rand_pool.c | 316 +++++++++++++++++++++ > CryptoPkg/Library/OpensslLib/rand_pool_noise.c | 29 ++ > CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c | 43 +++ > CryptoPkg/Library/OpensslLib/openssl | 2 +- > CryptoPkg/Library/OpensslLib/process_files.pl | 11 +- > 18 files changed, 669 insertions(+), 52 deletions(-) > create mode 100644 CryptoPkg/Library/Include/sys/syscall.h > create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.h > create mode 100644 CryptoPkg/Library/IntrinsicLib/Ia32/MathFtol.c > create mode 100644 CryptoPkg/Library/OpensslLib/ossl_store.c > create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool.c > create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.c > create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c > > -- > 2.7.4 > > > > > ^ permalink raw reply [flat|nested] 39+ messages in thread
* Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b 2019-05-17 9:17 ` Gary Lin @ 2019-05-18 7:26 ` Xiaoyu Lu 2019-05-20 1:48 ` Gary Lin 0 siblings, 1 reply; 39+ messages in thread From: Xiaoyu Lu @ 2019-05-18 7:26 UTC (permalink / raw) To: devel@edk2.groups.io, glin@suse.com; +Cc: Laszlo Ersek, Wang, Jian J, Ye, Ting Gary Lin, Because I divided commit(PATCH v4 6/7) into two patches. Can I pick your Tested-by tag for the two patches? Thanks Xiaoyu -----Original Message----- From: devel@edk2.groups.io [mailto:devel@edk2.groups.io] On Behalf Of Gary Lin Sent: Friday, May 17, 2019 5:17 PM To: devel@edk2.groups.io; Lu, XiaoyuX <xiaoyux.lu@intel.com> Cc: Laszlo Ersek <lersek@redhat.com>; Wang, Jian J <jian.j.wang@intel.com>; Ye, Ting <ting.ye@intel.com> Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b On Thu, May 16, 2019 at 03:54:51AM -0400, Xiaoyu lu wrote: > This series is also available at: > https://github.com/xiaoyuxlu/edk2/tree/bz_1089_upgrade_to_openssl_1_1_ > 1b_v4 > > Changes: > > (1) CryptoPkgOpensslLib: Modify process_files.pl for upgrading > OpenSSL > > (2) CryptoPkg/OpensslLib: Exclude unnecessary files in process_files.pl > crypto/store/* are excluded. > crypto/rand/randfile.c is excluded. > > (3) CryptoPkg/IntrinsicLib: Fix possible unresolved external symbol > issue > > (4) CryptoPkg/OpensslLib: Prepare for upgrading OpenSSL > Disable warnings for buiding OpenSSL_1_1_1b > > (5) CryptoPkg/OpensslLib: Fix cross-build problem for AARCH64 > > (6) CryptoPkg: Upgrade OpenSSL to 1.1.1b > The biggest change is use TSC as entropy source > If TSC isn't avaiable, fallback to TimerLib(PerformanceCounter). > > (7) CryptoPkg/BaseCryptLib: Make HMAC_CTX size backward compatible > > > Verification done for this series: > * Https boot in OvmfPkg. > * BaseCrypt Library test. (Ovmf, EmulatorPkg) > My https boot test with ovmf looks good. The connection was rejected as expected when the server certificate wasn't enrolled. The bootloader images were downloaded after adding the certificate, and I can boot into the installation UI in the end. I skipped the test for aavmf since TLS is still not enabled. For the series. Tested-by: Gary Lin <glin@suse.com> > Important notice: > Nt32Pkg doesn't support TimerLib > > TimerLib|MdePkg/Library/BaseTimerLibNullTemplate/BaseTimerLibNullTem > > TimerLib|plate.inf > So it will failed in Nt32Pkg. > > Cc: Jian J Wang <jian.j.wang@intel.com> > Cc: Ting Ye <ting.ye@intel.com> > > Laszlo Ersek (1): > CryptoPkg/OpensslLib: Fix cross-build problem for AARCH64 > > Xiaoyu Lu (6): > CryptoPkg/OpensslLib: Modify process_files.pl for upgrading OpenSSL > CryptoPkg/OpensslLib: Exclude unnecessary files in process_files.pl > CryptoPkg/IntrinsicLib: Fix possible unresolved external symbol issue > CryptoPkg/OpensslLib: Prepare for upgrading OpenSSL > CryptoPkg: Upgrade OpenSSL to 1.1.1b > CryptoPkg/BaseCryptLib: Make HMAC_CTX size backward compatible > > CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf | 4 +- > CryptoPkg/Library/OpensslLib/OpensslLib.inf | 76 ++++- > CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 67 ++++- > CryptoPkg/Library/Include/CrtLibSupport.h | 13 +- > CryptoPkg/Library/Include/openssl/opensslconf.h | 54 +++- > CryptoPkg/Library/Include/sys/syscall.h | 11 + > CryptoPkg/Library/OpensslLib/buildinf.h | 2 + > CryptoPkg/Library/OpensslLib/rand_pool_noise.h | 29 ++ > CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacMd5.c | 8 +- > .../Library/BaseCryptLib/Hmac/CryptHmacSha1.c | 9 +- > .../Library/BaseCryptLib/Hmac/CryptHmacSha256.c | 8 +- > CryptoPkg/Library/IntrinsicLib/Ia32/MathFtol.c | 22 ++ > CryptoPkg/Library/OpensslLib/ossl_store.c | 17 ++ > CryptoPkg/Library/OpensslLib/rand_pool.c | 316 +++++++++++++++++++++ > CryptoPkg/Library/OpensslLib/rand_pool_noise.c | 29 ++ > CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c | 43 +++ > CryptoPkg/Library/OpensslLib/openssl | 2 +- > CryptoPkg/Library/OpensslLib/process_files.pl | 11 +- > 18 files changed, 669 insertions(+), 52 deletions(-) create mode > 100644 CryptoPkg/Library/Include/sys/syscall.h > create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.h > create mode 100644 CryptoPkg/Library/IntrinsicLib/Ia32/MathFtol.c > create mode 100644 CryptoPkg/Library/OpensslLib/ossl_store.c > create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool.c > create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.c > create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c > > -- > 2.7.4 > > > > > ^ permalink raw reply [flat|nested] 39+ messages in thread
* Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b 2019-05-18 7:26 ` Xiaoyu Lu @ 2019-05-20 1:48 ` Gary Lin 0 siblings, 0 replies; 39+ messages in thread From: Gary Lin @ 2019-05-20 1:48 UTC (permalink / raw) To: devel, xiaoyux.lu; +Cc: Laszlo Ersek, Wang, Jian J, Ye, Ting On Sat, May 18, 2019 at 07:26:35AM +0000, Xiaoyu Lu wrote: > Gary Lin, > > Because I divided commit(PATCH v4 6/7) into two patches. Can I pick your Tested-by tag for the two patches? > If there is no functional change, my "Tested-by" is still valid. I can do the test again for v5 if you like. BTW, I forgot to state that my "Tested-by" doesn't include "PATCH v4 5/7" since I didn't build aarch64 aavmf due to lacking of https support. Thanks, Gary Lin > Thanks > Xiaoyu > -----Original Message----- > From: devel@edk2.groups.io [mailto:devel@edk2.groups.io] On Behalf Of Gary Lin > Sent: Friday, May 17, 2019 5:17 PM > To: devel@edk2.groups.io; Lu, XiaoyuX <xiaoyux.lu@intel.com> > Cc: Laszlo Ersek <lersek@redhat.com>; Wang, Jian J <jian.j.wang@intel.com>; Ye, Ting <ting.ye@intel.com> > Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b > > On Thu, May 16, 2019 at 03:54:51AM -0400, Xiaoyu lu wrote: > > This series is also available at: > > https://github.com/xiaoyuxlu/edk2/tree/bz_1089_upgrade_to_openssl_1_1_ > > 1b_v4 > > > > Changes: > > > > (1) CryptoPkgOpensslLib: Modify process_files.pl for upgrading > > OpenSSL > > > > (2) CryptoPkg/OpensslLib: Exclude unnecessary files in process_files.pl > > crypto/store/* are excluded. > > crypto/rand/randfile.c is excluded. > > > > (3) CryptoPkg/IntrinsicLib: Fix possible unresolved external symbol > > issue > > > > (4) CryptoPkg/OpensslLib: Prepare for upgrading OpenSSL > > Disable warnings for buiding OpenSSL_1_1_1b > > > > (5) CryptoPkg/OpensslLib: Fix cross-build problem for AARCH64 > > > > (6) CryptoPkg: Upgrade OpenSSL to 1.1.1b > > The biggest change is use TSC as entropy source > > If TSC isn't avaiable, fallback to TimerLib(PerformanceCounter). > > > > (7) CryptoPkg/BaseCryptLib: Make HMAC_CTX size backward compatible > > > > > > Verification done for this series: > > * Https boot in OvmfPkg. > > * BaseCrypt Library test. (Ovmf, EmulatorPkg) > > > My https boot test with ovmf looks good. The connection was rejected as expected when the server certificate wasn't enrolled. The bootloader images were downloaded after adding the certificate, and I can boot into the installation UI in the end. > > I skipped the test for aavmf since TLS is still not enabled. > > For the series. > Tested-by: Gary Lin <glin@suse.com> > > > Important notice: > > Nt32Pkg doesn't support TimerLib > > > TimerLib|MdePkg/Library/BaseTimerLibNullTemplate/BaseTimerLibNullTem > > > TimerLib|plate.inf > > So it will failed in Nt32Pkg. > > > > Cc: Jian J Wang <jian.j.wang@intel.com> > > Cc: Ting Ye <ting.ye@intel.com> > > > > Laszlo Ersek (1): > > CryptoPkg/OpensslLib: Fix cross-build problem for AARCH64 > > > > Xiaoyu Lu (6): > > CryptoPkg/OpensslLib: Modify process_files.pl for upgrading OpenSSL > > CryptoPkg/OpensslLib: Exclude unnecessary files in process_files.pl > > CryptoPkg/IntrinsicLib: Fix possible unresolved external symbol issue > > CryptoPkg/OpensslLib: Prepare for upgrading OpenSSL > > CryptoPkg: Upgrade OpenSSL to 1.1.1b > > CryptoPkg/BaseCryptLib: Make HMAC_CTX size backward compatible > > > > CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf | 4 +- > > CryptoPkg/Library/OpensslLib/OpensslLib.inf | 76 ++++- > > CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 67 ++++- > > CryptoPkg/Library/Include/CrtLibSupport.h | 13 +- > > CryptoPkg/Library/Include/openssl/opensslconf.h | 54 +++- > > CryptoPkg/Library/Include/sys/syscall.h | 11 + > > CryptoPkg/Library/OpensslLib/buildinf.h | 2 + > > CryptoPkg/Library/OpensslLib/rand_pool_noise.h | 29 ++ > > CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacMd5.c | 8 +- > > .../Library/BaseCryptLib/Hmac/CryptHmacSha1.c | 9 +- > > .../Library/BaseCryptLib/Hmac/CryptHmacSha256.c | 8 +- > > CryptoPkg/Library/IntrinsicLib/Ia32/MathFtol.c | 22 ++ > > CryptoPkg/Library/OpensslLib/ossl_store.c | 17 ++ > > CryptoPkg/Library/OpensslLib/rand_pool.c | 316 +++++++++++++++++++++ > > CryptoPkg/Library/OpensslLib/rand_pool_noise.c | 29 ++ > > CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c | 43 +++ > > CryptoPkg/Library/OpensslLib/openssl | 2 +- > > CryptoPkg/Library/OpensslLib/process_files.pl | 11 +- > > 18 files changed, 669 insertions(+), 52 deletions(-) create mode > > 100644 CryptoPkg/Library/Include/sys/syscall.h > > create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.h > > create mode 100644 CryptoPkg/Library/IntrinsicLib/Ia32/MathFtol.c > > create mode 100644 CryptoPkg/Library/OpensslLib/ossl_store.c > > create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool.c > > create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.c > > create mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c > > > > -- > > 2.7.4 > > > > > > > > > > > > > > > > > ^ permalink raw reply [flat|nested] 39+ messages in thread
* Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b 2019-05-16 7:54 [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b Xiaoyu lu ` (9 preceding siblings ...) 2019-05-17 9:17 ` Gary Lin @ 2019-05-21 21:14 ` Laszlo Ersek 2019-05-22 0:10 ` Michael D Kinney 10 siblings, 1 reply; 39+ messages in thread From: Laszlo Ersek @ 2019-05-21 21:14 UTC (permalink / raw) To: devel, xiaoyux.lu; +Cc: Jian J Wang, Ting Ye On 05/16/19 09:54, Xiaoyu lu wrote: > This series is also available at: > https://github.com/xiaoyuxlu/edk2/tree/bz_1089_upgrade_to_openssl_1_1_1b_v4 > > Changes: > > (1) CryptoPkgOpensslLib: Modify process_files.pl for upgrading OpenSSL > > (2) CryptoPkg/OpensslLib: Exclude unnecessary files in process_files.pl > crypto/store/* are excluded. > crypto/rand/randfile.c is excluded. > > (3) CryptoPkg/IntrinsicLib: Fix possible unresolved external symbol issue > > (4) CryptoPkg/OpensslLib: Prepare for upgrading OpenSSL > Disable warnings for buiding OpenSSL_1_1_1b > > (5) CryptoPkg/OpensslLib: Fix cross-build problem for AARCH64 > > (6) CryptoPkg: Upgrade OpenSSL to 1.1.1b > The biggest change is use TSC as entropy source > If TSC isn't avaiable, fallback to TimerLib(PerformanceCounter). > > (7) CryptoPkg/BaseCryptLib: Make HMAC_CTX size backward compatible > > > Verification done for this series: > * Https boot in OvmfPkg. > * BaseCrypt Library test. (Ovmf, EmulatorPkg) > > Important notice: > Nt32Pkg doesn't support TimerLib >> TimerLib|MdePkg/Library/BaseTimerLibNullTemplate/BaseTimerLibNullTemplate.inf > So it will failed in Nt32Pkg. > > Cc: Jian J Wang <jian.j.wang@intel.com> > Cc: Ting Ye <ting.ye@intel.com> This feature has missed edk2-stable201905. Please postpone the following BZ reference: https://bugzilla.tianocore.org/show_bug.cgi?id=1089 from https://github.com/tianocore/tianocore.github.io/wiki/EDK-II-Release-Planning#edk2-stable201905-tag-planning to https://github.com/tianocore/tianocore.github.io/wiki/EDK-II-Release-Planning#edk2-stable201908-tag-planning Thanks, Laszlo ^ permalink raw reply [flat|nested] 39+ messages in thread
* Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b 2019-05-21 21:14 ` Laszlo Ersek @ 2019-05-22 0:10 ` Michael D Kinney 2019-05-22 9:05 ` Laszlo Ersek 0 siblings, 1 reply; 39+ messages in thread From: Michael D Kinney @ 2019-05-22 0:10 UTC (permalink / raw) To: devel@edk2.groups.io, lersek@redhat.com, Lu, XiaoyuX, Kinney, Michael D Cc: Wang, Jian J, Ye, Ting Hi Laszlo, Another option we can consider is delaying the freeze windows and release date (if required) to accommodate the OpenSSL 1.1.1b feature. The following page shows that the current branch being used by EDK II (1.1.0j) with EOL on 9/11/2019. https://www.openssl.org/policies/releasestrat.html Best regards, Mike > -----Original Message----- > From: devel@edk2.groups.io > [mailto:devel@edk2.groups.io] On Behalf Of Laszlo Ersek > Sent: Tuesday, May 21, 2019 2:15 PM > To: devel@edk2.groups.io; Lu, XiaoyuX > <xiaoyux.lu@intel.com> > Cc: Wang, Jian J <jian.j.wang@intel.com>; Ye, Ting > <ting.ye@intel.com> > Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: > Upgrade OpenSSL to 1.1.1b > > On 05/16/19 09:54, Xiaoyu lu wrote: > > This series is also available at: > > > https://github.com/xiaoyuxlu/edk2/tree/bz_1089_upgrade_ > to_openssl_1_1_1b_v4 > > > > Changes: > > > > (1) CryptoPkgOpensslLib: Modify process_files.pl for > upgrading OpenSSL > > > > (2) CryptoPkg/OpensslLib: Exclude unnecessary files > in process_files.pl > > crypto/store/* are excluded. > > crypto/rand/randfile.c is excluded. > > > > (3) CryptoPkg/IntrinsicLib: Fix possible unresolved > external symbol issue > > > > (4) CryptoPkg/OpensslLib: Prepare for upgrading > OpenSSL > > Disable warnings for buiding OpenSSL_1_1_1b > > > > (5) CryptoPkg/OpensslLib: Fix cross-build problem for > AARCH64 > > > > (6) CryptoPkg: Upgrade OpenSSL to 1.1.1b > > The biggest change is use TSC as entropy source > > If TSC isn't avaiable, fallback to > TimerLib(PerformanceCounter). > > > > (7) CryptoPkg/BaseCryptLib: Make HMAC_CTX size > backward compatible > > > > > > Verification done for this series: > > * Https boot in OvmfPkg. > > * BaseCrypt Library test. (Ovmf, EmulatorPkg) > > > > Important notice: > > Nt32Pkg doesn't support TimerLib > >> > TimerLib|MdePkg/Library/BaseTimerLibNullTemplate/BaseTi > merLibNullTemplate.inf > > So it will failed in Nt32Pkg. > > > > Cc: Jian J Wang <jian.j.wang@intel.com> > > Cc: Ting Ye <ting.ye@intel.com> > > This feature has missed edk2-stable201905. > > Please postpone the following BZ reference: > > https://bugzilla.tianocore.org/show_bug.cgi?id=1089 > > from > > > https://github.com/tianocore/tianocore.github.io/wiki/E > DK-II-Release-Planning#edk2-stable201905-tag-planning > > to > > > https://github.com/tianocore/tianocore.github.io/wiki/E > DK-II-Release-Planning#edk2-stable201908-tag-planning > > Thanks, > Laszlo > > ^ permalink raw reply [flat|nested] 39+ messages in thread
* Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b 2019-05-22 0:10 ` Michael D Kinney @ 2019-05-22 9:05 ` Laszlo Ersek 0 siblings, 0 replies; 39+ messages in thread From: Laszlo Ersek @ 2019-05-22 9:05 UTC (permalink / raw) To: Kinney, Michael D, devel@edk2.groups.io, Lu, XiaoyuX Cc: Wang, Jian J, Ye, Ting On 05/22/19 02:10, Kinney, Michael D wrote: > Hi Laszlo, > > Another option we can consider is delaying the > freeze windows and release date (if required) to > accommodate the OpenSSL 1.1.1b feature. Yes, that's reasonable. And, the same argument could apply to <https://bugzilla.tianocore.org/show_bug.cgi?id=1293>. As I just wrote in another email, we might want to generally switch to a feature-oriented release schedule, from a purely time-based one. It solves some issues, and raises some others (such as: feature creep, indefinite slips, and debates about what features are critical). I'm open to such a workflow change. Thanks! Laszlo > The following page shows that the current branch > being used by EDK II (1.1.0j) with EOL on 9/11/2019. > > https://www.openssl.org/policies/releasestrat.html > > Best regards, > > Mike > >> -----Original Message----- >> From: devel@edk2.groups.io >> [mailto:devel@edk2.groups.io] On Behalf Of Laszlo Ersek >> Sent: Tuesday, May 21, 2019 2:15 PM >> To: devel@edk2.groups.io; Lu, XiaoyuX >> <xiaoyux.lu@intel.com> >> Cc: Wang, Jian J <jian.j.wang@intel.com>; Ye, Ting >> <ting.ye@intel.com> >> Subject: Re: [edk2-devel] [PATCH v4 0/7] CryptoPkg: >> Upgrade OpenSSL to 1.1.1b >> >> On 05/16/19 09:54, Xiaoyu lu wrote: >>> This series is also available at: >>> >> https://github.com/xiaoyuxlu/edk2/tree/bz_1089_upgrade_ >> to_openssl_1_1_1b_v4 >>> >>> Changes: >>> >>> (1) CryptoPkgOpensslLib: Modify process_files.pl for >> upgrading OpenSSL >>> >>> (2) CryptoPkg/OpensslLib: Exclude unnecessary files >> in process_files.pl >>> crypto/store/* are excluded. >>> crypto/rand/randfile.c is excluded. >>> >>> (3) CryptoPkg/IntrinsicLib: Fix possible unresolved >> external symbol issue >>> >>> (4) CryptoPkg/OpensslLib: Prepare for upgrading >> OpenSSL >>> Disable warnings for buiding OpenSSL_1_1_1b >>> >>> (5) CryptoPkg/OpensslLib: Fix cross-build problem for >> AARCH64 >>> >>> (6) CryptoPkg: Upgrade OpenSSL to 1.1.1b >>> The biggest change is use TSC as entropy source >>> If TSC isn't avaiable, fallback to >> TimerLib(PerformanceCounter). >>> >>> (7) CryptoPkg/BaseCryptLib: Make HMAC_CTX size >> backward compatible >>> >>> >>> Verification done for this series: >>> * Https boot in OvmfPkg. >>> * BaseCrypt Library test. (Ovmf, EmulatorPkg) >>> >>> Important notice: >>> Nt32Pkg doesn't support TimerLib >>>> >> TimerLib|MdePkg/Library/BaseTimerLibNullTemplate/BaseTi >> merLibNullTemplate.inf >>> So it will failed in Nt32Pkg. >>> >>> Cc: Jian J Wang <jian.j.wang@intel.com> >>> Cc: Ting Ye <ting.ye@intel.com> >> >> This feature has missed edk2-stable201905. >> >> Please postpone the following BZ reference: >> >> https://bugzilla.tianocore.org/show_bug.cgi?id=1089 >> >> from >> >> >> https://github.com/tianocore/tianocore.github.io/wiki/E >> DK-II-Release-Planning#edk2-stable201905-tag-planning >> >> to >> >> >> https://github.com/tianocore/tianocore.github.io/wiki/E >> DK-II-Release-Planning#edk2-stable201908-tag-planning >> >> Thanks, >> Laszlo >> >> > ^ permalink raw reply [flat|nested] 39+ messages in thread
end of thread, other threads:[~2019-05-23 5:10 UTC | newest]
Thread overview: 39+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-05-16 7:54 [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b Xiaoyu lu
2019-05-16 7:54 ` [PATCH v4 1/7] CryptoPkg/OpensslLib: Modify process_files.pl for upgrading OpenSSL Xiaoyu lu
2019-05-16 7:54 ` [PATCH v4 2/7] CryptoPkg/OpensslLib: Exclude unnecessary files in process_files.pl Xiaoyu lu
2019-05-16 15:51 ` [edk2-devel] " Laszlo Ersek
2019-05-16 7:54 ` [PATCH v4 3/7] CryptoPkg/IntrinsicLib: Fix possible unresolved external symbol issue Xiaoyu lu
2019-05-16 7:54 ` [PATCH v4 4/7] CryptoPkg/OpensslLib: Prepare for upgrading OpenSSL Xiaoyu lu
2019-05-16 7:54 ` [PATCH v4 5/7] CryptoPkg/OpensslLib: Fix cross-build problem for AARCH64 Xiaoyu lu
2019-05-16 15:58 ` [edk2-devel] " Laszlo Ersek
2019-05-16 7:54 ` [PATCH v4 6/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b Xiaoyu lu
2019-05-16 16:31 ` [edk2-devel] " Laszlo Ersek
2019-05-17 11:14 ` Xiaoyu Lu
2019-05-17 13:15 ` Laszlo Ersek
2019-05-18 7:16 ` Xiaoyu Lu
2019-05-16 7:54 ` [PATCH v4 7/7] CryptoPkg/BaseCryptLib: Make HMAC_CTX size backward compatible Xiaoyu lu
2019-05-16 18:25 ` [edk2-devel] [PATCH v4 0/7] CryptoPkg: Upgrade OpenSSL to 1.1.1b Laszlo Ersek
2019-05-17 5:11 ` Wang, Jian J
2019-05-17 13:04 ` Laszlo Ersek
2019-05-17 13:16 ` Laszlo Ersek
2019-05-17 15:06 ` Ard Biesheuvel
2019-05-20 1:40 ` Wang, Jian J
[not found] ` <15A0408CA29C0595.820@groups.io>
2019-05-21 7:43 ` Wang, Jian J
2019-05-21 9:01 ` Ard Biesheuvel
2019-05-21 9:09 ` Wang, Jian J
2019-05-21 12:23 ` Laszlo Ersek
2019-05-21 13:02 ` Wang, Jian J
2019-05-21 13:34 ` Laszlo Ersek
2019-05-21 13:39 ` Ard Biesheuvel
2019-05-23 5:10 ` Wang, Jian J
2019-05-17 10:12 ` Xiaoyu Lu
2019-05-17 13:08 ` Laszlo Ersek
2019-05-18 7:37 ` Xiaoyu Lu
2019-05-16 18:53 ` Laszlo Ersek
2019-05-17 5:00 ` [edk2-devel] " Wang, Jian J
2019-05-17 9:17 ` Gary Lin
2019-05-18 7:26 ` Xiaoyu Lu
2019-05-20 1:48 ` Gary Lin
2019-05-21 21:14 ` Laszlo Ersek
2019-05-22 0:10 ` Michael D Kinney
2019-05-22 9:05 ` Laszlo Ersek
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox