Skip to content

Commit 04373f7

Browse files
Donnie-IceDonnie-Ice
authored
Merge pull request #440 from nasa/402-quickfix-kmc-should-not-call-get_key
402 quickfix kmc should not call get key
2 parents e549775 + 2a938a0 commit 04373f7

27 files changed

+489
-301
lines changed

‎CMakeLists.txt

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -35,23 +35,23 @@ set(CRYPTO_CUSTOM_PATH_DEFAULT "../../crypto/custom")
3535
# For flags with the same prefix, one or more may be enabled
3636
#
3737
option(CODECOV "Code Coverage" OFF)
38-
option(CRYPTO_LIBGCRYPT "Cryptography Module - Libgcrypt" ON)
38+
option(CRYPTO_LIBGCRYPT "Cryptography Module - Libgcrypt" OFF)
3939
option(CRYPTO_KMC "Cryptography Module - KMC" OFF)
4040
option(CRYPTO_WOLFSSL "Cryptography Module - WolfSSL" OFF)
4141
option(CRYPTO_CUSTOM "Cryptography Module - CUSTOM" OFF)
4242
option(CRYPTO_CUSTOM_PATH "Cryptography Module - CUSTOM PATH" OFF)
4343
option(DEBUG "Debug" OFF)
4444
option(KEY_CUSTOM "Key Module - Custom" OFF)
4545
option(KEY_CUSTOM_PATH "Custom Key Path" OFF)
46-
option(KEY_INTERNAL "Key Module - Internal" ON)
46+
option(KEY_INTERNAL "Key Module - Internal" OFF)
4747
option(KEY_KMC "Key Module - KMC" OFF)
4848
option(MC_CUSTOM "Monitoring and Control - Custom" OFF)
4949
option(MC_CUSTOM_PATH "Custom Monitoring and Control path" OFF)
5050
option(MC_DISABLED "Monitoring and Control - Disabled" OFF)
51-
option(MC_INTERNAL "Monitoring and Control - Internal" ON)
51+
option(MC_INTERNAL "Monitoring and Control - Internal" OFF)
5252
option(SA_CUSTOM "Security Association - Custom" OFF)
5353
option(SA_CUSTOM_PATH "Custom Security Association Path" OFF)
54-
option(SA_INTERNAL "Security Association - Internal" ON)
54+
option(SA_INTERNAL "Security Association - Internal" OFF)
5555
option(SA_MARIADB "Security Association - MariaDB" OFF)
5656
option(SUPPORT "Support" OFF)
5757
option(SYSTEM_INSTALL "SystemInstall" OFF)
@@ -164,7 +164,6 @@ ENDIF(KMC_MDB_DB)
164164
IF(CRYPTO_EPROC)
165165
ADD_DEFINITIONS(-DCRYPTO_EPROC)
166166
message(WARNING "Cryptolib Extended Procedures NOT complete. NOT Fully tested. Use at own risk!")
167-
168167
ENDIF(CRYPTO_EPROC)
169168

170169
if(SYSTEM_INSTALL)

‎include/crypto_config_structs.h

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -191,10 +191,10 @@ typedef enum
191191
{
192192
CRYPTO_CIPHER_NONE,
193193
CRYPTO_CIPHER_AES256_GCM,
194-
CRYPTO_CIPHER_AES256_GCM_SIV,
195194
CRYPTO_CIPHER_AES256_CBC,
196195
CRYPTO_CIPHER_AES256_CBC_MAC,
197-
CRYPTO_CIPHER_AES256_CCM
196+
CRYPTO_CIPHER_AES256_CCM,
197+
CRYPTO_CIPHER_AES256_GCM_SIV
198198
} EncCipherSuite;
199199

200200
/*

‎include/crypto_error.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@
3636
#define SADB_QUERY_FAILED 301
3737
#define SADB_QUERY_EMPTY_RESULTS 302
3838
#define SADB_INSERT_FAILED 303
39+
#define SADB_INVALID_SA_FIELD_VALUE 304
3940

4041
#define CRYPTOGRAPHY_INVALID_CRYPTO_INTERFACE_TYPE 400
4142
#define CRYPTOGRAPHY_UNSUPPORTED_OPERATION_FOR_KEY_RING 401
@@ -165,7 +166,7 @@
165166
#define CRYPTO_INTERFACE_ERROR_CODES_MAX 402
166167

167168
#define SADB_ERROR_CODES 300
168-
#define SADB_ERROR_CODES_MAX 303
169+
#define SADB_ERROR_CODES_MAX 304
169170

170171
#define SADB_INTERFACE_ERROR_CODES 200
171172
#define SADB_INTERFACE_ERROR_CODES_MAX 201

‎src/core/crypto_aos.c

Lines changed: 50 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -415,31 +415,34 @@ int32_t Crypto_AOS_ApplySecurity(uint8_t *pTfBuffer, uint16_t len_ingest)
415415
// Get Key
416416
crypto_key_t *ekp = NULL;
417417
crypto_key_t *akp = NULL;
418-
ekp = key_if->get_key(sa_ptr->ekid);
419-
akp = key_if->get_key(sa_ptr->akid);
420-
421-
if (ekp == NULL || akp == NULL)
422-
{
423-
status = CRYPTO_LIB_ERR_KEY_ID_ERROR;
424-
mc_if->mc_log(status);
425-
return status;
426-
}
427-
if (sa_ptr->est == 1)
418+
if (crypto_config.key_type != KEY_TYPE_KMC)
428419
{
429-
if (ekp->key_state != KEY_ACTIVE)
420+
ekp = key_if->get_key(sa_ptr->ekid);
421+
akp = key_if->get_key(sa_ptr->akid);
422+
423+
if (ekp == NULL || akp == NULL)
430424
{
431-
status = CRYPTO_LIB_ERR_KEY_STATE_INVALID;
425+
status = CRYPTO_LIB_ERR_KEY_ID_ERROR;
432426
mc_if->mc_log(status);
433427
return status;
434428
}
435-
}
436-
if (sa_ptr->ast == 1)
437-
{
438-
if (akp->key_state != KEY_ACTIVE)
429+
if (sa_ptr->est == 1)
439430
{
440-
status = CRYPTO_LIB_ERR_KEY_STATE_INVALID;
441-
mc_if->mc_log(status);
442-
return status;
431+
if (ekp->key_state != KEY_ACTIVE)
432+
{
433+
status = CRYPTO_LIB_ERR_KEY_STATE_INVALID;
434+
mc_if->mc_log(status);
435+
return status;
436+
}
437+
}
438+
if (sa_ptr->ast == 1)
439+
{
440+
if (akp->key_state != KEY_ACTIVE)
441+
{
442+
status = CRYPTO_LIB_ERR_KEY_STATE_INVALID;
443+
mc_if->mc_log(status);
444+
return status;
445+
}
443446
}
444447
}
445448

@@ -1052,34 +1055,40 @@ int32_t Crypto_AOS_ProcessSecurity(uint8_t *p_ingest, uint16_t len_ingest, uint8
10521055

10531056
if (sa_ptr->est == 1)
10541057
{
1055-
ekp = key_if->get_key(sa_ptr->ekid);
1056-
if (ekp == NULL)
1058+
if (crypto_config.key_type != KEY_TYPE_KMC)
10571059
{
1058-
status = CRYPTO_LIB_ERR_KEY_ID_ERROR;
1059-
mc_if->mc_log(status);
1060-
return status;
1061-
}
1062-
if (ekp->key_state != KEY_ACTIVE)
1063-
{
1064-
status = CRYPTO_LIB_ERR_KEY_STATE_INVALID;
1065-
mc_if->mc_log(status);
1066-
return status;
1060+
ekp = key_if->get_key(sa_ptr->ekid);
1061+
if (ekp == NULL)
1062+
{
1063+
status = CRYPTO_LIB_ERR_KEY_ID_ERROR;
1064+
mc_if->mc_log(status);
1065+
return status;
1066+
}
1067+
if (ekp->key_state != KEY_ACTIVE)
1068+
{
1069+
status = CRYPTO_LIB_ERR_KEY_STATE_INVALID;
1070+
mc_if->mc_log(status);
1071+
return status;
1072+
}
10671073
}
10681074
}
10691075
if (sa_ptr->ast == 1)
10701076
{
1071-
akp = key_if->get_key(sa_ptr->akid);
1072-
if (akp == NULL)
1073-
{
1074-
status = CRYPTO_LIB_ERR_KEY_ID_ERROR;
1075-
mc_if->mc_log(status);
1076-
return status;
1077-
}
1078-
if (akp->key_state != KEY_ACTIVE)
1077+
if (crypto_config.key_type != KEY_TYPE_KMC)
10791078
{
1080-
status = CRYPTO_LIB_ERR_KEY_STATE_INVALID;
1081-
mc_if->mc_log(status);
1082-
return status;
1079+
akp = key_if->get_key(sa_ptr->akid);
1080+
if (akp == NULL)
1081+
{
1082+
status = CRYPTO_LIB_ERR_KEY_ID_ERROR;
1083+
mc_if->mc_log(status);
1084+
return status;
1085+
}
1086+
if (akp->key_state != KEY_ACTIVE)
1087+
{
1088+
status = CRYPTO_LIB_ERR_KEY_STATE_INVALID;
1089+
mc_if->mc_log(status);
1090+
return status;
1091+
}
10831092
}
10841093
}
10851094

‎src/core/crypto_config.c

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -281,28 +281,38 @@ int32_t Crypto_Init(void)
281281
// Determine which cryptographic module is in use
282282
if (cryptography_if == NULL)
283283
{
284-
cryptography_if = get_cryptography_interface_libgcrypt();
285-
if (cryptography_if == NULL)
284+
if (crypto_config.cryptography_type == CRYPTOGRAPHY_TYPE_LIBGCRYPT)
285+
{
286+
cryptography_if = get_cryptography_interface_libgcrypt();
287+
}
288+
else if (crypto_config.cryptography_type == CRYPTOGRAPHY_TYPE_WOLFSSL)
286289
{
287290
cryptography_if = get_cryptography_interface_wolfssl();
288291
}
289-
if (cryptography_if == NULL)
292+
else if (crypto_config.cryptography_type == CRYPTOGRAPHY_TYPE_CUSTOM)
290293
{
291294
cryptography_if = get_cryptography_interface_custom();
292295
}
293-
if (cryptography_if == NULL)
294-
{ // Note this needs to be the last option in the chain due to addition configuration required
296+
else if (crypto_config.cryptography_type == CRYPTOGRAPHY_TYPE_KMCCRYPTO)
297+
{
295298
if (cryptography_kmc_crypto_config != NULL)
296299
{
297300
cryptography_if = get_cryptography_interface_kmc_crypto_service();
298301
}
302+
else
303+
{
304+
#ifdef DEBUG
305+
printf("KMC Crypto_Service not configured\n");
306+
#endif
307+
}
299308
}
300309
if (cryptography_if == NULL)
301310
{
302311
#ifdef DEBUG
303312
printf("Fatal Error: Unable to identify Cryptography Interface!\n");
304313
#endif
305314
status = CRYPTOGRAPHY_INVALID_CRYPTO_INTERFACE_TYPE;
315+
return status;
306316
}
307317
}
308318

@@ -372,8 +382,6 @@ int32_t Crypto_Shutdown(void)
372382
{
373383
int32_t status = CRYPTO_LIB_SUCCESS;
374384

375-
crypto_free_config_structs();
376-
377385
// current_managed_parameters = NULL;
378386
current_managed_parameters_struct = gvcid_null_struct;
379387
for (int i = 0; i <= gvcid_counter; i++)
@@ -407,6 +415,8 @@ int32_t Crypto_Shutdown(void)
407415
cryptography_if = NULL;
408416
}
409417

418+
crypto_free_config_structs();
419+
410420
return status;
411421
}
412422

‎src/core/crypto_error.c

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -115,10 +115,9 @@ char *crypto_enum_errlist_sa_if[] = {
115115
(char *)"SADB_NULL_SA_USED",
116116
};
117117
char *crypto_enum_errlist_sa_mariadb[] = {
118-
(char *)"SADB_MARIADB_CONNECTION_FAILED",
119-
(char *)"SADB_QUERY_FAILED",
120-
(char *)"SADB_QUERY_EMPTY_RESULTS",
121-
(char *)"SADB_INSERT_FAILED",
118+
(char *)"SADB_MARIADB_CONNECTION_FAILED", (char *)"SADB_QUERY_FAILED",
119+
(char *)"SADB_QUERY_EMPTY_RESULTS", (char *)"SADB_INSERT_FAILED",
120+
(char *)"SADB_INVALID_SA_FIELD_VALUE",
122121
};
123122
char *crypto_enum_errlist_crypto_if[] = {
124123
(char *)"CRYPTOGRAPHY_INVALID_CRYPTO_INTERFACE_TYPE",

0 commit comments

Comments
 (0)