f370d400ee
Resolves: https://issues.redhat.com/browse/RHELPLAN-171792 Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
123 lines
4.3 KiB
Diff
123 lines
4.3 KiB
Diff
From f429bf3ffd992c678f7d1a041f6a6b5df9a4b6fb Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
|
|
Date: Fri, 1 Mar 2024 13:25:14 +0000
|
|
Subject: [PATCH 203/203] Disable sm2 and sm4 crypto algorithms
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
Policy copied from Fedora 39 openssl package
|
|
|
|
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
|
|
---
|
|
Linux/build_openssl.sh | 2 +-
|
|
Linux/sgx/test_app/enclave/TestEnclave.cpp | 5 ++++-
|
|
Linux/sgx/test_app/enclave/TestEnclave.h | 4 ++++
|
|
Linux/sgx/test_app/enclave/tests/evp_smx.c | 4 ++++
|
|
4 files changed, 13 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/Linux/build_openssl.sh b/Linux/build_openssl.sh
|
|
index 7470479..e214ccb 100755
|
|
--- a/Linux/build_openssl.sh
|
|
+++ b/Linux/build_openssl.sh
|
|
@@ -156,7 +156,7 @@ cp sgx_config.conf $OPENSSL_VERSION/ || exit 1
|
|
cp x86_64-xlate.pl $OPENSSL_VERSION/crypto/perlasm/ || exit 1
|
|
|
|
cd $SGXSSL_ROOT/../openssl_source/$OPENSSL_VERSION || exit 1
|
|
-perl Configure --config=sgx_config.conf sgx-linux-x86_64 --with-rand-seed=none $ADDITIONAL_CONF $SPACE_OPT $MITIGATION_FLAGS $ENCLAVE_CFLAGS no-idea no-mdc2 no-rc5 no-rc4 no-bf no-ec2m no-camellia no-cast no-srp no-async no-padlockeng no-dso no-shared no-ssl3 no-md2 no-md4 no-ui-console no-stdio no-afalgeng -D_FORTIFY_SOURCE=2 -DGETPID_IS_MEANINGLESS -include$SGXSSL_ROOT/../openssl_source/bypass_to_sgxssl.h || exit 1
|
|
+perl Configure --config=sgx_config.conf sgx-linux-x86_64 --with-rand-seed=none $ADDITIONAL_CONF $SPACE_OPT $MITIGATION_FLAGS $ENCLAVE_CFLAGS no-idea no-mdc2 no-rc5 no-rc4 no-bf no-ec2m no-camellia no-cast no-srp no-async no-padlockeng no-dso no-shared no-ssl3 no-md2 no-md4 no-sm2 no-sm4 no-ui-console no-stdio no-afalgeng -D_FORTIFY_SOURCE=2 -DGETPID_IS_MEANINGLESS -include$SGXSSL_ROOT/../openssl_source/bypass_to_sgxssl.h || exit 1
|
|
|
|
sed -i 's/ENGINE_set_default_RAND/dummy_ENGINE_set_default_RAND/' crypto/engine/tb_rand.c || exit 1
|
|
sed -i 's/return RUN_ONCE(&locale_base, ossl_init_locale_base);/return 1;/' crypto/ctype.c || exit 1
|
|
diff --git a/Linux/sgx/test_app/enclave/TestEnclave.cpp b/Linux/sgx/test_app/enclave/TestEnclave.cpp
|
|
index dac620a..b219e74 100644
|
|
--- a/Linux/sgx/test_app/enclave/TestEnclave.cpp
|
|
+++ b/Linux/sgx/test_app/enclave/TestEnclave.cpp
|
|
@@ -413,6 +413,7 @@ void t_sgxssl_call_apis()
|
|
}
|
|
printf("test threads_test completed\n");
|
|
|
|
+#if 0
|
|
//GM SM2 - sign and verify
|
|
ret = ecall_sm2_sign_verify();
|
|
if (ret != 0)
|
|
@@ -430,6 +431,7 @@ void t_sgxssl_call_apis()
|
|
exit(ret);
|
|
}
|
|
printf("test evp_sm2_encrypt_decrypt completed\n");
|
|
+#endif
|
|
|
|
//GM SM3 - compute digest of message
|
|
ret = ecall_sm3();
|
|
@@ -440,6 +442,7 @@ void t_sgxssl_call_apis()
|
|
}
|
|
printf("test evp_sm3 completed\n");
|
|
|
|
+#if 0
|
|
//GM SM4 - cbc encrypt and decrypt
|
|
ret = ecall_sm4_cbc();
|
|
if (ret != 0)
|
|
@@ -457,5 +460,5 @@ void t_sgxssl_call_apis()
|
|
exit(ret);
|
|
}
|
|
printf("test evp_sm4_ctr completed\n");
|
|
-
|
|
+#endif
|
|
}
|
|
diff --git a/Linux/sgx/test_app/enclave/TestEnclave.h b/Linux/sgx/test_app/enclave/TestEnclave.h
|
|
index c2ca854..a989735 100644
|
|
--- a/Linux/sgx/test_app/enclave/TestEnclave.h
|
|
+++ b/Linux/sgx/test_app/enclave/TestEnclave.h
|
|
@@ -66,11 +66,15 @@ int sha256_test();
|
|
int sha1_test();
|
|
int hmac_tests();
|
|
int threads_test();
|
|
+#if 0
|
|
int ecall_sm2_sign_verify();
|
|
int ecall_sm2_encrypt_decrypt();
|
|
+#endif
|
|
int ecall_sm3();
|
|
+#if 0
|
|
int ecall_sm4_cbc();
|
|
int ecall_sm4_ctr();
|
|
+#endif
|
|
|
|
#if defined(__cplusplus)
|
|
}
|
|
diff --git a/Linux/sgx/test_app/enclave/tests/evp_smx.c b/Linux/sgx/test_app/enclave/tests/evp_smx.c
|
|
index a395ce8..f49e5b7 100644
|
|
--- a/Linux/sgx/test_app/enclave/tests/evp_smx.c
|
|
+++ b/Linux/sgx/test_app/enclave/tests/evp_smx.c
|
|
@@ -44,6 +44,7 @@
|
|
#define SAFE_FREE(ptr, size) {if (NULL != (ptr)) {memset_s(ptr, size, 0, size); free(ptr); (ptr)=NULL;}}
|
|
#endif
|
|
|
|
+#if 0
|
|
// Default sm2_user_id and its length defined by openssl
|
|
unsigned char sm2_user_id[] = "1234567812345678";
|
|
unsigned int sm2_user_id_len = sizeof(sm2_user_id)-1;
|
|
@@ -512,6 +513,7 @@ end:
|
|
|
|
return ret;
|
|
}
|
|
+#endif
|
|
|
|
/* Compute a SM3 digest of a message. */
|
|
int ecall_sm3(void)
|
|
@@ -571,6 +573,7 @@ end:
|
|
return ret;
|
|
}
|
|
|
|
+#if 0
|
|
/* SM4 block cipher mode(cbc) of operation. */
|
|
int ecall_sm4_cbc(void)
|
|
{
|
|
@@ -743,3 +746,4 @@ end:
|
|
|
|
return ret;
|
|
}
|
|
+#endif
|
|
--
|
|
2.46.0
|
|
|