Skip to content

Commit a462a60

Browse files
gaojiaqi7jyao1
gaojiaqi7
authored and
jyao1
committedOct 31, 2023
upgrade ring to 0.17.5
- Upgrade `ring` git submodule. - Update patch and patch script `preparation.h`. - Update the use of `PublicKey`and `EcdsaKeyPair` to follow the latest API. - Update `Cargo.toml`s and `Cargo.lock`. Signed-off-by: Jiaqi Gao <[email protected]>
·
v0.8.0
1 parent 3f18d9f commit a462a60

File tree

11 files changed

+126
-105
lines changed

11 files changed

+126
-105
lines changed
 

‎Cargo.lock

+5-17
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎cc-measurement/Cargo.toml

+1-1
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ edition = "2021"
77

88
[dependencies]
99
sha2 = { version = "0.10.6", default-features = false, features = ["force-soft"], optional = true }
10-
ring = { version = "0.16.20", default-features = false, features = ["alloc"], optional = true }
10+
ring = { version = "0.17.5", default-features = false, features = ["alloc"], optional = true }
1111
zerocopy = "0.6.0"
1212

1313
[features]

‎library/patches/ring.diff

+83-64
Original file line numberDiff line numberDiff line change
@@ -1,90 +1,109 @@
11
diff --git a/Cargo.toml b/Cargo.toml
2-
index c9daac82e..f9e578e39 100644
2+
index 3378dc84b..f65fd70bd 100644
33
--- a/Cargo.toml
44
+++ b/Cargo.toml
5-
@@ -302,6 +302,7 @@ name = "ring"
5+
@@ -171,7 +171,7 @@ all-features = true
6+
name = "ring"
67

78
[dependencies]
8-
untrusted = { version = "0.7.1" }
9-
+getrandom = { version = "0.2.8", features = ["rdrand"] }
9+
-getrandom = { version = "0.2.10" }
10+
+getrandom = { version = "0.2.10", features = ["rdrand"] }
11+
untrusted = { version = "0.9" }
1012

11-
[target.'cfg(any(target_arch = "x86",target_arch = "x86_64", all(any(target_arch = "aarch64", target_arch = "arm"), any(target_os = "android", target_os = "fuchsia", target_os = "linux"))))'.dependencies]
12-
spin = { version = "0.5.2", default-features = false }
13-
@@ -327,7 +328,7 @@ libc = { version = "0.2.80", default-features = false }
14-
15-
# Keep this in sync with `[dependencies]` in pregenerate_asm/Cargo.toml.
16-
[build-dependencies]
17-
-cc = { version = "1.0.62", default-features = false }
18-
+cc = { version = "1.0.63", default-features = false }
19-
20-
[features]
21-
# These features are documented in the top-level module's documentation.
13+
[target.'cfg(any(target_arch = "x86",target_arch = "x86_64", all(any(target_arch = "aarch64", target_arch = "arm"), any(target_os = "android", target_os = "fuchsia", target_os = "linux", target_os = "windows"))))'.dependencies]
2214
diff --git a/build.rs b/build.rs
23-
index a5a8e1995..c67e4bfb0 100644
15+
index f7b94108b..3bdc8cd29 100644
2416
--- a/build.rs
2517
+++ b/build.rs
26-
@@ -580,7 +580,7 @@ fn cc(
27-
//
18+
@@ -121,7 +121,9 @@ fn cpp_flags(compiler: &cc::Tool) -> &'static [&'static str] {
19+
"-Wenum-compare",
20+
"-Wfloat-equal",
21+
"-Wformat=2",
22+
- "-Winline",
23+
+ // Clear the `-Winline` because warnings will be treated as errors
24+
+ // when `ring` is used as git submodules.
25+
+ // "-Winline",
26+
"-Winvalid-pch",
27+
"-Wmissing-field-initializers",
28+
"-Wmissing-include-dirs",
29+
@@ -260,6 +262,8 @@ const LINUX_ABI: &[&str] = &[
30+
"linux",
31+
"redox",
32+
"solaris",
33+
+ // For `x86_64-unknown-none` target
34+
+ "none",
35+
];
36+
37+
/// Operating systems that have the same ABI as macOS on every architecture
38+
@@ -604,16 +608,29 @@ fn configure_cc(c: &mut cc::Build, target: &Target, include_dir: &Path) {
2839
// poly1305_vec.c requires <emmintrin.h> which requires <stdlib.h>.
29-
if (target.arch == "wasm32" && target.os == "unknown")
30-
- || (target.os == "linux" && is_musl && target.arch != "x86_64")
31-
+ || (target.os == "linux" && is_musl && target.arch != "x86_64" || target.os == "none")
40+
if (target.arch == "wasm32")
41+
|| (target.os == "linux" && target.is_musl && target.arch != "x86_64")
42+
+ || (target.os == "none")
3243
{
3344
if let Ok(compiler) = c.try_get_compiler() {
3445
// TODO: Expand this to non-clang compilers in 0.17.0 if practical.
35-
@@ -589,6 +589,9 @@ fn cc(
36-
let _ = c.define("GFp_NOSTDLIBINC", "1");
46+
if compiler.is_like_clang() {
47+
let _ = c.flag("-nostdlibinc");
48+
+ // Required on windows for cross compilation to `x86_64-unknown-none`
49+
+ let _ = c.flag("-ffreestanding");
50+
let _ = c.define("RING_CORE_NOSTDLIBINC", "1");
3751
}
3852
}
39-
+ if target.os == "none" {
40-
+ let _ = c.flag("-ffreestanding");
53+
}
54+
55+
+ // `clang` does not define `__ELF__` for `x86_64-unknown-none` target.
56+
+ // Manually define it.
57+
+ if target.os == "none" {
58+
+ if let Ok(compiler) = c.try_get_compiler() {
59+
+ if compiler.is_like_clang() {
60+
+ let _ = c.define("__ELF__", None);
61+
+ }
4162
+ }
63+
+ }
64+
+
65+
if target.force_warnings_into_errors {
66+
c.warnings_into_errors(true);
4267
}
68+
@@ -645,7 +662,7 @@ fn nasm(file: &Path, arch: &str, include_dir: &Path, out_file: &Path) -> Command
69+
std::path::MAIN_SEPARATOR,
70+
)));
4371

44-
if warnings_are_errors {
45-
@@ -626,7 +629,7 @@ fn nasm(file: &Path, arch: &str, out_file: &Path) -> Command {
46-
"x86" => ("win32"),
47-
_ => panic!("unsupported arch: {}", arch),
48-
};
49-
- let mut c = Command::new("./target/tools/nasm");
72+
- let mut c = Command::new("./target/tools/windows/nasm/nasm");
5073
+ let mut c = Command::new("nasm");
5174
let _ = c
5275
.arg("-o")
5376
.arg(out_file.to_str().expect("Invalid path"))
5477
diff --git a/src/rand.rs b/src/rand.rs
55-
index 9d1864fa1..6ac5cc727 100644
78+
index 78f4bdc3c..2d1028b84 100644
5679
--- a/src/rand.rs
5780
+++ b/src/rand.rs
58-
@@ -195,6 +195,9 @@ use self::darwin::fill as fill_impl;
59-
#[cfg(any(target_os = "fuchsia"))]
60-
use self::fuchsia::fill as fill_impl;
81+
@@ -148,6 +148,7 @@ impl crate::sealed::Sealed for SystemRandom {}
82+
all(target_os = "unknown", feature = "wasm32_unknown_unknown_js")
83+
)
84+
),
85+
+ all(target_arch = "x86_64", target_os = "none"),
86+
))]
87+
impl sealed::SecureRandom for SystemRandom {
88+
#[inline(always)]
89+
diff --git a/third_party/fiat/curve25519_64_adx.h b/third_party/fiat/curve25519_64_adx.h
90+
index 9dcbb69fa..0906fda81 100644
91+
--- a/third_party/fiat/curve25519_64_adx.h
92+
+++ b/third_party/fiat/curve25519_64_adx.h
93+
@@ -1,7 +1,6 @@
94+
#include <stdbool.h>
95+
#include <stdint.h>
96+
#include <immintrin.h>
97+
-#include <string.h>
6198

62-
+#[cfg(any(target_os = "none"))]
63-
+use self::no_std::fill as fill_impl;
64-
+
65-
#[cfg(any(target_os = "android", target_os = "linux"))]
66-
mod sysrand_chunk {
67-
use crate::{c, error};
68-
@@ -431,3 +434,22 @@ mod fuchsia {
69-
fn zx_cprng_draw(buffer: *mut u8, length: usize);
70-
}
71-
}
72-
+
73-
+#[cfg(any(target_os = "none"))]
74-
+mod no_std {
75-
+ use crate::error;
76-
+
77-
+ pub fn fill(dest: &mut [u8]) -> Result<(), error::Unspecified> {
78-
+ fill_impl(dest)
79-
+ }
80-
+
81-
+ #[cfg(not(any(target_arch = "x86_64")))]
82-
+ fn fill_impl(dest: &mut [u8]) -> Result<(), error::Unspecified> {
83-
+ Err(error::Unspecified)
84-
+ }
85-
+
86-
+ #[cfg(any(target_arch = "x86_64"))]
87-
+ fn fill_impl(dest: &mut [u8]) -> Result<(), error::Unspecified> {
88-
+ getrandom::getrandom(dest).map_err(|_| error::Unspecified)
89-
+ }
90-
+}
99+
typedef uint64_t fe4[4];
100+
typedef uint8_t fiat_uint1;
101+
@@ -469,7 +468,7 @@ __attribute__((target("adx,bmi2")))
102+
void x25519_scalar_mult_adx(uint8_t out[32], const uint8_t scalar[32],
103+
const uint8_t point[32]) {
104+
uint8_t e[32];
105+
- memcpy(e, scalar, 32);
106+
+ OPENSSL_memcpy(e, scalar, 32);
107+
e[0] &= 248;
108+
e[31] &= 127;
109+
e[31] |= 64;

‎library/ring

Submodule ring updated 240 files

‎sh_script/preparation.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
preparation() {
44
# apply the patch set for ring
55
pushd library/ring
6-
git reset --hard 9cc0d45f4d8521f467bb3a621e74b1535e118188
6+
git reset --hard c3fda8b4dd57d658923c397c6cfaa33591f6f256
77
git clean -f -d
88
patch -p 1 -i ../patches/ring.diff
99
popd

‎td-shim-tools/Cargo.toml

+1-1
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ der = { version = "0.4.5", features = ["oid"], optional = true }
5252
env_logger = { version = "0.9.0", optional = true }
5353
log = { version = "0.4.5", optional = true }
5454
td-loader = { path = "../td-loader", optional = true }
55-
ring = { version = "0.16.20", optional = true }
55+
ring = { version = "0.17.5", optional = true }
5656
serde_json = { version = "1.0", optional = true }
5757
serde = { version = "1.0", features = ["derive"], optional = true }
5858
hex = { version = "0.4", features = ["serde"], optional = true }

‎td-shim-tools/src/bin/td-shim-sign-payload/main.rs

+14-7
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,10 @@ use std::{env, io, path::Path};
1212
use clap::ArgAction;
1313
use env_logger::Env;
1414
use log::{error, trace, LevelFilter};
15-
use ring::signature::{EcdsaKeyPair, RsaKeyPair, ECDSA_P384_SHA384_FIXED_SIGNING};
15+
use ring::{
16+
rand,
17+
signature::{EcdsaKeyPair, RsaKeyPair, ECDSA_P384_SHA384_FIXED_SIGNING},
18+
};
1619
use td_layout::build_time::TD_SHIM_PAYLOAD_SIZE;
1720
use td_shim_tools::signer::{PayloadSigner, SigningAlgorithm};
1821
use td_shim_tools::{InputData, OutputFile};
@@ -107,12 +110,16 @@ fn main() -> io::Result<()> {
107110
SigningAlgorithm::Rsapss3072Sha384(rsa_key_pair)
108111
}
109112
"ECDSA_NIST_P384_SHA384" => {
110-
let ecdsa_key_pair =
111-
EcdsaKeyPair::from_pkcs8(&ECDSA_P384_SHA384_FIXED_SIGNING, private.as_bytes())
112-
.map_err(|e| {
113-
error!("Can not load DSA private key from {}: {}", private_file, e);
114-
io::Error::new(io::ErrorKind::Other, "Can not load DSA private key")
115-
})?;
113+
let rng = rand::SystemRandom::new();
114+
let ecdsa_key_pair = EcdsaKeyPair::from_pkcs8(
115+
&ECDSA_P384_SHA384_FIXED_SIGNING,
116+
private.as_bytes(),
117+
&rng,
118+
)
119+
.map_err(|e| {
120+
error!("Can not load DSA private key from {}: {}", private_file, e);
121+
io::Error::new(io::ErrorKind::Other, "Can not load DSA private key")
122+
})?;
116123
SigningAlgorithm::EcdsaNistP384Sha384(ecdsa_key_pair)
117124
}
118125
_ => {

‎td-shim-tools/src/signer.rs

+12-11
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ use std::io;
66
use std::mem::size_of;
77
use std::vec::Vec;
88

9+
use der::Decodable;
910
use log::error;
1011
use ring::rand;
1112
use ring::signature::{EcdsaKeyPair, KeyPair, RsaKeyPair, RSA_PSS_SHA384};
@@ -14,6 +15,8 @@ use td_shim::secure_boot::{
1415
PAYLOAD_SIGN_RSA_PSS_3072_SHA384, SIGNED_PAYLOAD_FILE_HEADER_GUID,
1516
};
1617

18+
use crate::public_key::RsaPublicKeyInfo;
19+
1720
/// Type of public key.
1821
pub enum SigningAlgorithm {
1922
Rsapss3072Sha384(RsaKeyPair),
@@ -52,25 +55,23 @@ impl<'a> PayloadSigner<'a> {
5255

5356
match &self.algorithm {
5457
SigningAlgorithm::Rsapss3072Sha384(rsa_keypair) => {
55-
let modulus = rsa_keypair
56-
.public_key()
57-
.modulus()
58-
.big_endian_without_leading_zero();
59-
if rsa_keypair.public_modulus_len() != 384 {
58+
let public = rsa_keypair.public().as_ref();
59+
let public_der = RsaPublicKeyInfo::from_der(public).map_err(|_| {
60+
io::Error::new(io::ErrorKind::InvalidInput, "invalid RSA public key")
61+
})?;
62+
let modulus = public_der.modulus.as_bytes();
63+
if rsa_keypair.public().modulus_len() != 384 {
6064
error!(
6165
"Invalid RSA public modulus length: {}",
62-
rsa_keypair.public_modulus_len()
66+
rsa_keypair.public().modulus_len()
6367
);
6468
return Err(io::Error::new(
6569
io::ErrorKind::InvalidInput,
6670
"invalid RSA public modulus length",
6771
));
6872
}
6973

70-
let exponent = rsa_keypair
71-
.public_key()
72-
.exponent()
73-
.big_endian_without_leading_zero();
74+
let exponent = public_der.exponents.as_bytes();
7475
if exponent.len() > PAYLOAD_SIGN_RSA_EXPONENT_SIZE {
7576
error!(
7677
"Invalid RSA exponent length: {}, max {}",
@@ -87,7 +88,7 @@ impl<'a> PayloadSigner<'a> {
8788
exp_bytes[PAYLOAD_SIGN_RSA_EXPONENT_SIZE - exponent.len()..]
8889
.copy_from_slice(exponent);
8990

90-
let mut signature: Vec<u8> = vec![0; rsa_keypair.public_modulus_len()];
91+
let mut signature: Vec<u8> = vec![0; rsa_keypair.public().modulus_len()];
9192
rsa_keypair
9293
.sign(&RSA_PSS_SHA384, &rng, &self.signed_image, &mut signature)
9394
.map_err(|e| {

‎td-shim/Cargo.toml

+1-1
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ zerocopy = "0.6.0"
3030
td-loader = { path = "../td-loader", optional = true }
3131
linked_list_allocator = { version = "0.10", optional = true }
3232
log = { version = "0.4.13", features = ["release_max_level_off"], optional = true }
33-
ring = { version = "0.16.20", default-features = false, features = ["alloc"], optional = true }
33+
ring = { version = "0.17.5", default-features = false, features = ["alloc"], optional = true }
3434
spin = { version = "0.9.2", optional = true }
3535
td-exception = { path = "../td-exception", features = ["tdx"], optional = true }
3636
td-logger = { path = "../td-logger", optional = true }

‎td-shim/src/bin/td-shim/main.rs

+6
Original file line numberDiff line numberDiff line change
@@ -428,3 +428,9 @@ fn secure_boot_verify_payload<'a>(
428428
return PayloadVerifier::get_payload_image(payload)
429429
.expect("Unable to get payload image from signed binary");
430430
}
431+
432+
#[cfg(feature = "secure-boot")]
433+
#[no_mangle]
434+
extern "C" fn __assert_fail() {
435+
panic!("__assert_fail");
436+
}

‎tests/test-td-payload/Cargo.toml

+1-1
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ scroll = { version = "0.10.0", default-features = false, features = ["derive"]}
2222
serde = { version = "1.0", default-features = false, features = ["derive"]}
2323
serde_json = { version = "1.0", default-features = false, features = ["alloc"] }
2424
x86 = { version = "0.47.0" }
25-
ring = { version = "0.16.20", default-features = false, features = ["alloc"] }
25+
ring = { version = "0.17.5", default-features = false, features = ["alloc"] }
2626
td-shim = { path = "../../td-shim" }
2727
td-payload = { path = "../../td-payload", features = ["tdx","cet-shstk","stack-guard"] }
2828
zerocopy = "0.6.0"

0 commit comments

Comments
 (0)
Please sign in to comment.