openwrt-mirror/packages
1
0 Fork 0
mirror of https://github.com/openwrt/packages.git synced 2026-10-12 05:57:04 +04:00
Code Issues Packages Projects Releases Wiki Activity

libjuice: fix SHA-1 on big-endian targets

Browse Source 
libjuice's vendored picohash guards the final byte-order swap in
_picohash_sha1_final with SHA_BIG_ENDIAN, which nothing defines, while
endianness is detected into _PICOHASH_BIG_ENDIAN. On big-endian targets
the swap runs when it must not and every SHA-1 digest is emitted with each
32-bit word reversed, taking HMAC-SHA1 with it.

libjuice uses HMAC-SHA1 for STUN MESSAGE-INTEGRITY, so on mips, mips64,
powerpc and every other big-endian target each ICE connectivity check is
rejected as failing integrity. No candidate pair is nominated and no
session can be established. picohash is the default backend, as USE_NETTLE
is off, so this affects the package as built here.

Verified on lantiq/xrx200 (mips_24kc, MIPS 34Kc): before the patch an ICE
agent loops with "STUN integrity check failed" and never leaves the
connecting state; after it the agent reaches completed and a session comes
up over the DHT and ICE. RFC 2202 HMAC-SHA1 test case 1 and the SHA-1
vector for "abc" both fail before and pass after.

Submitted upstream as paullouisageneau/libjuice#353 and, for the vendored
copy's origin, kazuho/picohash#13.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
This commit is contained in:
Daniel Golle committed 2026-09-01 01:17:38 +01:00
1 parent 738480840d
commit 088999ef3d
2 files changed
+43 -1
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

libs/libjuice/Makefile
+1 -1
View File
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
PKG_NAME:=libjuice
PKG_VERSION:=1.7.3
PKG_RELEASE:=1
PKG_RELEASE:=2
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://codeload.github.com/paullouisageneau/libjuice/tar.gz/v$(PKG_VERSION)?
libs/libjuice/patches/0001-picohash-guard-the-SHA-1-output-swap-with-the-macro-.patch
+42
View File
@@ -0,0 +1,42 @@
From 44a0f4ae30ac0b62a8cc5aa9f3e2d54d40c31a75 Mon Sep 17 00:00:00 2001
From: Daniel Golle <daniel@makrotopia.org>
Date: Tue, 1 Sep 2026 00:25:27 +0100
Subject: [PATCH] picohash: guard the SHA-1 output swap with the macro picohash
defines
The final "swap byte order back" step in _picohash_sha1_final is guarded by
SHA_BIG_ENDIAN, which nothing defines. picohash detects endianness into
_PICOHASH_BIG_ENDIAN, and that is what the matching byte store in
_picohash_sha1_add_uncounted tests. The name comes from liboauth's sha1.c,
which this SHA-1 implementation is adopted from, and is present upstream in
kazuho/picohash as well.
On a big-endian target the swap runs when it must not, so every SHA-1 digest
is emitted with each 32-bit word reversed, and HMAC-SHA1 with it. STUN
MESSAGE-INTEGRITY therefore never verifies: every ICE connectivity check is
rejected, no candidate pair is nominated, and no session can be established.
picohash is the default backend, so this affects any big-endian build that
does not set USE_NETTLE.
Verified on mips_24kc, a big-endian MIPS 34Kc running OpenWrt with musl.
Before the change, ICE loops with "STUN integrity check failed" and the agent
never leaves the connecting state. After it, the agent reaches completed and
the session comes up. RFC 2202 HMAC-SHA1 test case 1 and the SHA-1 vector for
"abc" both fail before and pass after.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
---
src/picohash.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/src/picohash.h
+++ b/src/picohash.h
@@ -452,7 +452,7 @@ inline void _picohash_sha1_final(_picoha
_picohash_sha1_add_uncounted(s, (uint8_t)(s->byteCount >> 5));
_picohash_sha1_add_uncounted(s, (uint8_t)(s->byteCount << 3));
-#ifndef SHA_BIG_ENDIAN
+#ifndef _PICOHASH_BIG_ENDIAN
{ // Swap byte order back
int i;
for (i = 0; i < 5; i++) {