From: Daniel Golle Date: Mon, 31 Aug 2026 23:27:47 +0000 (+0100) Subject: libjuice: fix SHA-1 on big-endian targets X-Git-Url: http://git.99rst.org/?a=commitdiff_plain;h=088999ef3d4a2065e9b36357c3c1365eb18783cd;p=openwrt-packages.git libjuice: fix SHA-1 on big-endian targets libjuice's vendored picohash guards the final byte-order swap in _picohash_sha1_final with SHA_BIG_ENDIAN, which nothing defines, while endianness is detected into _PICOHASH_BIG_ENDIAN. On big-endian targets the swap runs when it must not and every SHA-1 digest is emitted with each 32-bit word reversed, taking HMAC-SHA1 with it. libjuice uses HMAC-SHA1 for STUN MESSAGE-INTEGRITY, so on mips, mips64, powerpc and every other big-endian target each ICE connectivity check is rejected as failing integrity. No candidate pair is nominated and no session can be established. picohash is the default backend, as USE_NETTLE is off, so this affects the package as built here. Verified on lantiq/xrx200 (mips_24kc, MIPS 34Kc): before the patch an ICE agent loops with "STUN integrity check failed" and never leaves the connecting state; after it the agent reaches completed and a session comes up over the DHT and ICE. RFC 2202 HMAC-SHA1 test case 1 and the SHA-1 vector for "abc" both fail before and pass after. Submitted upstream as paullouisageneau/libjuice#353 and, for the vendored copy's origin, kazuho/picohash#13. Signed-off-by: Daniel Golle --- diff --git a/libs/libjuice/Makefile b/libs/libjuice/Makefile index 5235f6341..d42e8efa3 100644 --- a/libs/libjuice/Makefile +++ b/libs/libjuice/Makefile @@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=libjuice PKG_VERSION:=1.7.3 -PKG_RELEASE:=1 +PKG_RELEASE:=2 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz PKG_SOURCE_URL:=https://codeload.github.com/paullouisageneau/libjuice/tar.gz/v$(PKG_VERSION)? diff --git a/libs/libjuice/patches/0001-picohash-guard-the-SHA-1-output-swap-with-the-macro-.patch b/libs/libjuice/patches/0001-picohash-guard-the-SHA-1-output-swap-with-the-macro-.patch new file mode 100644 index 000000000..78dd7c9cb --- /dev/null +++ b/libs/libjuice/patches/0001-picohash-guard-the-SHA-1-output-swap-with-the-macro-.patch @@ -0,0 +1,42 @@ +From 44a0f4ae30ac0b62a8cc5aa9f3e2d54d40c31a75 Mon Sep 17 00:00:00 2001 +From: Daniel Golle +Date: Tue, 1 Sep 2026 00:25:27 +0100 +Subject: [PATCH] picohash: guard the SHA-1 output swap with the macro picohash + defines + +The final "swap byte order back" step in _picohash_sha1_final is guarded by +SHA_BIG_ENDIAN, which nothing defines. picohash detects endianness into +_PICOHASH_BIG_ENDIAN, and that is what the matching byte store in +_picohash_sha1_add_uncounted tests. The name comes from liboauth's sha1.c, +which this SHA-1 implementation is adopted from, and is present upstream in +kazuho/picohash as well. + +On a big-endian target the swap runs when it must not, so every SHA-1 digest +is emitted with each 32-bit word reversed, and HMAC-SHA1 with it. STUN +MESSAGE-INTEGRITY therefore never verifies: every ICE connectivity check is +rejected, no candidate pair is nominated, and no session can be established. +picohash is the default backend, so this affects any big-endian build that +does not set USE_NETTLE. + +Verified on mips_24kc, a big-endian MIPS 34Kc running OpenWrt with musl. +Before the change, ICE loops with "STUN integrity check failed" and the agent +never leaves the connecting state. After it, the agent reaches completed and +the session comes up. RFC 2202 HMAC-SHA1 test case 1 and the SHA-1 vector for +"abc" both fail before and pass after. + +Signed-off-by: Daniel Golle +--- + src/picohash.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/src/picohash.h ++++ b/src/picohash.h +@@ -452,7 +452,7 @@ inline void _picohash_sha1_final(_picoha + _picohash_sha1_add_uncounted(s, (uint8_t)(s->byteCount >> 5)); + _picohash_sha1_add_uncounted(s, (uint8_t)(s->byteCount << 3)); + +-#ifndef SHA_BIG_ENDIAN ++#ifndef _PICOHASH_BIG_ENDIAN + { // Swap byte order back + int i; + for (i = 0; i < 5; i++) {