]>
Commit | Line | Data |
---|---|---|
9efa0ae0 | 1 | /* |
fecb3aae | 2 | * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved. |
9efa0ae0 MC |
3 | * |
4 | * Licensed under the Apache License 2.0 (the "License"). You may not use | |
5 | * this file except in compliance with the License. You can obtain a copy | |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
8 | */ | |
9 | ||
6ce58488 | 10 | #include <assert.h> |
23c48d94 | 11 | #include <openssl/core_dispatch.h> |
9efa0ae0 MC |
12 | #include <openssl/core_names.h> |
13 | #include <openssl/params.h> | |
25e60144 | 14 | #include <openssl/fips_names.h> |
7d615e21 | 15 | #include <openssl/rand.h> /* RAND_get0_public() */ |
2741128e | 16 | #include <openssl/proverr.h> |
3593266d | 17 | #include "internal/cryptlib.h" |
af3e7e1b | 18 | #include "prov/implementations.h" |
e2f5df36 | 19 | #include "prov/names.h" |
ddd21319 RL |
20 | #include "prov/provider_ctx.h" |
21 | #include "prov/providercommon.h" | |
0d2bfe52 | 22 | #include "prov/provider_util.h" |
08edd447 | 23 | #include "prov/seeding.h" |
36fc5fc6 | 24 | #include "self_test.h" |
927d0566 | 25 | #include "crypto/context.h" |
c5e7de5d | 26 | #include "internal/core.h" |
9efa0ae0 | 27 | |
dcb71e1c SL |
28 | static const char FIPS_DEFAULT_PROPERTIES[] = "provider=fips,fips=yes"; |
29 | static const char FIPS_UNAPPROVED_PROPERTIES[] = "provider=fips,fips=no"; | |
30 | ||
fdaad3f1 RL |
31 | /* |
32 | * Forward declarations to ensure that interface functions are correctly | |
33 | * defined. | |
34 | */ | |
363b1e5d DMSP |
35 | static OSSL_FUNC_provider_teardown_fn fips_teardown; |
36 | static OSSL_FUNC_provider_gettable_params_fn fips_gettable_params; | |
37 | static OSSL_FUNC_provider_get_params_fn fips_get_params; | |
38 | static OSSL_FUNC_provider_query_operation_fn fips_query; | |
fdaad3f1 | 39 | |
c5e7de5d DB |
40 | /* Locale object accessor functions */ |
41 | #ifdef OPENSSL_SYS_MACOSX | |
42 | # include <xlocale.h> | |
43 | #else | |
44 | # include <locale.h> | |
45 | #endif | |
46 | ||
47 | #if defined OPENSSL_SYS_WINDOWS | |
48 | # define locale_t _locale_t | |
49 | # define freelocale _free_locale | |
50 | #endif | |
51 | static locale_t loc; | |
52 | ||
53 | static int fips_init_casecmp(void); | |
54 | static void fips_deinit_casecmp(void); | |
55 | ||
dcb71e1c | 56 | #define ALGC(NAMES, FUNC, CHECK) { { NAMES, FIPS_DEFAULT_PROPERTIES, FUNC }, CHECK } |
0d2bfe52 SL |
57 | #define ALG(NAMES, FUNC) ALGC(NAMES, FUNC, NULL) |
58 | ||
363b1e5d | 59 | extern OSSL_FUNC_core_thread_start_fn *c_thread_start; |
6ce58488 | 60 | int FIPS_security_check_enabled(OSSL_LIB_CTX *libctx); |
b60cba3c | 61 | |
da747958 | 62 | /* |
6ce58488 MC |
63 | * Should these function pointers be stored in the provider side provctx? Could |
64 | * they ever be different from one init to the next? We assume not for now. | |
da747958 | 65 | */ |
25e60144 | 66 | |
9efa0ae0 | 67 | /* Functions provided by the core */ |
363b1e5d DMSP |
68 | static OSSL_FUNC_core_gettable_params_fn *c_gettable_params; |
69 | static OSSL_FUNC_core_get_params_fn *c_get_params; | |
70 | OSSL_FUNC_core_thread_start_fn *c_thread_start; | |
71 | static OSSL_FUNC_core_new_error_fn *c_new_error; | |
72 | static OSSL_FUNC_core_set_error_debug_fn *c_set_error_debug; | |
73 | static OSSL_FUNC_core_vset_error_fn *c_vset_error; | |
74 | static OSSL_FUNC_core_set_error_mark_fn *c_set_error_mark; | |
75 | static OSSL_FUNC_core_clear_last_error_mark_fn *c_clear_last_error_mark; | |
76 | static OSSL_FUNC_core_pop_error_to_mark_fn *c_pop_error_to_mark; | |
77 | static OSSL_FUNC_CRYPTO_malloc_fn *c_CRYPTO_malloc; | |
78 | static OSSL_FUNC_CRYPTO_zalloc_fn *c_CRYPTO_zalloc; | |
79 | static OSSL_FUNC_CRYPTO_free_fn *c_CRYPTO_free; | |
80 | static OSSL_FUNC_CRYPTO_clear_free_fn *c_CRYPTO_clear_free; | |
81 | static OSSL_FUNC_CRYPTO_realloc_fn *c_CRYPTO_realloc; | |
82 | static OSSL_FUNC_CRYPTO_clear_realloc_fn *c_CRYPTO_clear_realloc; | |
83 | static OSSL_FUNC_CRYPTO_secure_malloc_fn *c_CRYPTO_secure_malloc; | |
84 | static OSSL_FUNC_CRYPTO_secure_zalloc_fn *c_CRYPTO_secure_zalloc; | |
85 | static OSSL_FUNC_CRYPTO_secure_free_fn *c_CRYPTO_secure_free; | |
86 | static OSSL_FUNC_CRYPTO_secure_clear_free_fn *c_CRYPTO_secure_clear_free; | |
87 | static OSSL_FUNC_CRYPTO_secure_allocated_fn *c_CRYPTO_secure_allocated; | |
88 | static OSSL_FUNC_BIO_vsnprintf_fn *c_BIO_vsnprintf; | |
04cb5ec0 | 89 | static OSSL_FUNC_self_test_cb_fn *c_stcbfn = NULL; |
a829b735 | 90 | static OSSL_FUNC_core_get_libctx_fn *c_get_libctx = NULL; |
9efa0ae0 | 91 | |
da747958 | 92 | typedef struct fips_global_st { |
d40b42ab | 93 | const OSSL_CORE_HANDLE *handle; |
6ce58488 MC |
94 | SELF_TEST_POST_PARAMS selftest_params; |
95 | int fips_security_checks; | |
96 | const char *fips_security_check_option; | |
da747958 MC |
97 | } FIPS_GLOBAL; |
98 | ||
927d0566 | 99 | void *ossl_fips_prov_ossl_ctx_new(OSSL_LIB_CTX *libctx) |
da747958 MC |
100 | { |
101 | FIPS_GLOBAL *fgbl = OPENSSL_zalloc(sizeof(*fgbl)); | |
102 | ||
6ce58488 MC |
103 | if (fgbl == NULL) |
104 | return NULL; | |
105 | fgbl->fips_security_checks = 1; | |
106 | fgbl->fips_security_check_option = "1"; | |
107 | ||
da747958 MC |
108 | return fgbl; |
109 | } | |
110 | ||
927d0566 | 111 | void ossl_fips_prov_ossl_ctx_free(void *fgbl) |
da747958 MC |
112 | { |
113 | OPENSSL_free(fgbl); | |
114 | } | |
115 | ||
9efa0ae0 | 116 | /* Parameters we provide to the core */ |
26175013 RL |
117 | static const OSSL_PARAM fips_param_types[] = { |
118 | OSSL_PARAM_DEFN(OSSL_PROV_PARAM_NAME, OSSL_PARAM_UTF8_PTR, NULL, 0), | |
119 | OSSL_PARAM_DEFN(OSSL_PROV_PARAM_VERSION, OSSL_PARAM_UTF8_PTR, NULL, 0), | |
120 | OSSL_PARAM_DEFN(OSSL_PROV_PARAM_BUILDINFO, OSSL_PARAM_UTF8_PTR, NULL, 0), | |
6cf37302 | 121 | OSSL_PARAM_DEFN(OSSL_PROV_PARAM_STATUS, OSSL_PARAM_INTEGER, NULL, 0), |
991a6bb5 | 122 | OSSL_PARAM_DEFN(OSSL_PROV_PARAM_SECURITY_CHECKS, OSSL_PARAM_INTEGER, NULL, 0), |
26175013 | 123 | OSSL_PARAM_END |
9efa0ae0 MC |
124 | }; |
125 | ||
6ce58488 MC |
126 | static int fips_get_params_from_core(FIPS_GLOBAL *fgbl) |
127 | { | |
128 | /* | |
129 | * Parameters to retrieve from the core provider - required for self testing. | |
130 | * NOTE: inside core_get_params() these will be loaded from config items | |
131 | * stored inside prov->parameters (except for | |
132 | * OSSL_PROV_PARAM_CORE_MODULE_FILENAME). | |
133 | * OSSL_PROV_FIPS_PARAM_SECURITY_CHECKS is not a self test parameter. | |
134 | */ | |
135 | OSSL_PARAM core_params[8], *p = core_params; | |
136 | ||
137 | *p++ = OSSL_PARAM_construct_utf8_ptr( | |
138 | OSSL_PROV_PARAM_CORE_MODULE_FILENAME, | |
139 | (char **)&fgbl->selftest_params.module_filename, | |
140 | sizeof(fgbl->selftest_params.module_filename)); | |
141 | *p++ = OSSL_PARAM_construct_utf8_ptr( | |
142 | OSSL_PROV_FIPS_PARAM_MODULE_MAC, | |
143 | (char **)&fgbl->selftest_params.module_checksum_data, | |
144 | sizeof(fgbl->selftest_params.module_checksum_data)); | |
145 | *p++ = OSSL_PARAM_construct_utf8_ptr( | |
146 | OSSL_PROV_FIPS_PARAM_INSTALL_MAC, | |
147 | (char **)&fgbl->selftest_params.indicator_checksum_data, | |
148 | sizeof(fgbl->selftest_params.indicator_checksum_data)); | |
149 | *p++ = OSSL_PARAM_construct_utf8_ptr( | |
150 | OSSL_PROV_FIPS_PARAM_INSTALL_STATUS, | |
151 | (char **)&fgbl->selftest_params.indicator_data, | |
152 | sizeof(fgbl->selftest_params.indicator_data)); | |
153 | *p++ = OSSL_PARAM_construct_utf8_ptr( | |
154 | OSSL_PROV_FIPS_PARAM_INSTALL_VERSION, | |
155 | (char **)&fgbl->selftest_params.indicator_version, | |
156 | sizeof(fgbl->selftest_params.indicator_version)); | |
157 | *p++ = OSSL_PARAM_construct_utf8_ptr( | |
158 | OSSL_PROV_FIPS_PARAM_CONDITIONAL_ERRORS, | |
159 | (char **)&fgbl->selftest_params.conditional_error_check, | |
160 | sizeof(fgbl->selftest_params.conditional_error_check)); | |
161 | *p++ = OSSL_PARAM_construct_utf8_ptr( | |
162 | OSSL_PROV_FIPS_PARAM_SECURITY_CHECKS, | |
163 | (char **)&fgbl->fips_security_check_option, | |
164 | sizeof(fgbl->fips_security_check_option)); | |
165 | *p = OSSL_PARAM_construct_end(); | |
166 | ||
167 | if (!c_get_params(fgbl->handle, core_params)) { | |
168 | ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER); | |
169 | return 0; | |
170 | } | |
171 | ||
172 | return 1; | |
173 | } | |
25e60144 | 174 | |
fdaad3f1 | 175 | static const OSSL_PARAM *fips_gettable_params(void *provctx) |
9efa0ae0 MC |
176 | { |
177 | return fips_param_types; | |
178 | } | |
179 | ||
fdaad3f1 | 180 | static int fips_get_params(void *provctx, OSSL_PARAM params[]) |
9efa0ae0 | 181 | { |
4e7991b4 | 182 | OSSL_PARAM *p; |
6ce58488 | 183 | FIPS_GLOBAL *fgbl = ossl_lib_ctx_get_data(ossl_prov_ctx_get0_libctx(provctx), |
927d0566 | 184 | OSSL_LIB_CTX_FIPS_PROV_INDEX); |
9efa0ae0 MC |
185 | |
186 | p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_NAME); | |
187 | if (p != NULL && !OSSL_PARAM_set_utf8_ptr(p, "OpenSSL FIPS Provider")) | |
188 | return 0; | |
189 | p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_VERSION); | |
190 | if (p != NULL && !OSSL_PARAM_set_utf8_ptr(p, OPENSSL_VERSION_STR)) | |
191 | return 0; | |
192 | p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_BUILDINFO); | |
193 | if (p != NULL && !OSSL_PARAM_set_utf8_ptr(p, OPENSSL_FULL_VERSION_STR)) | |
194 | return 0; | |
04cb5ec0 | 195 | p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_STATUS); |
6cf37302 | 196 | if (p != NULL && !OSSL_PARAM_set_int(p, ossl_prov_is_running())) |
04cb5ec0 | 197 | return 0; |
991a6bb5 | 198 | p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_SECURITY_CHECKS); |
6ce58488 | 199 | if (p != NULL && !OSSL_PARAM_set_int(p, fgbl->fips_security_checks)) |
991a6bb5 | 200 | return 0; |
9efa0ae0 MC |
201 | return 1; |
202 | } | |
203 | ||
6ce58488 | 204 | static void set_self_test_cb(FIPS_GLOBAL *fgbl) |
04cb5ec0 | 205 | { |
6ce58488 MC |
206 | const OSSL_CORE_HANDLE *handle = |
207 | FIPS_get_core_handle(fgbl->selftest_params.libctx); | |
208 | ||
04cb5ec0 | 209 | if (c_stcbfn != NULL && c_get_libctx != NULL) { |
6ce58488 MC |
210 | c_stcbfn(c_get_libctx(handle), &fgbl->selftest_params.cb, |
211 | &fgbl->selftest_params.cb_arg); | |
04cb5ec0 | 212 | } else { |
6ce58488 MC |
213 | fgbl->selftest_params.cb = NULL; |
214 | fgbl->selftest_params.cb_arg = NULL; | |
04cb5ec0 SL |
215 | } |
216 | } | |
217 | ||
218 | static int fips_self_test(void *provctx) | |
219 | { | |
6ce58488 | 220 | FIPS_GLOBAL *fgbl = ossl_lib_ctx_get_data(ossl_prov_ctx_get0_libctx(provctx), |
927d0566 | 221 | OSSL_LIB_CTX_FIPS_PROV_INDEX); |
6ce58488 MC |
222 | |
223 | set_self_test_cb(fgbl); | |
224 | return SELF_TEST_post(&fgbl->selftest_params, 1) ? 1 : 0; | |
04cb5ec0 SL |
225 | } |
226 | ||
df553b79 RL |
227 | /* |
228 | * For the algorithm names, we use the following formula for our primary | |
229 | * names: | |
230 | * | |
231 | * ALGNAME[VERSION?][-SUBNAME[VERSION?]?][-SIZE?][-MODE?] | |
232 | * | |
233 | * VERSION is only present if there are multiple versions of | |
234 | * an alg (MD2, MD4, MD5). It may be omitted if there is only | |
235 | * one version (if a subsequent version is released in the future, | |
236 | * we can always change the canonical name, and add the old name | |
237 | * as an alias). | |
238 | * | |
239 | * SUBNAME may be present where we are combining multiple | |
240 | * algorithms together, e.g. MD5-SHA1. | |
241 | * | |
242 | * SIZE is only present if multiple versions of an algorithm exist | |
243 | * with different sizes (e.g. AES-128-CBC, AES-256-CBC) | |
244 | * | |
245 | * MODE is only present where applicable. | |
246 | * | |
247 | * We add diverse other names where applicable, such as the names that | |
248 | * NIST uses, or that are used for ASN.1 OBJECT IDENTIFIERs, or names | |
249 | * we have used historically. | |
250 | */ | |
9efa0ae0 | 251 | static const OSSL_ALGORITHM fips_digests[] = { |
df553b79 | 252 | /* Our primary name:NiST name[:our older names] */ |
e2f5df36 RL |
253 | { PROV_NAMES_SHA1, FIPS_DEFAULT_PROPERTIES, ossl_sha1_functions }, |
254 | { PROV_NAMES_SHA2_224, FIPS_DEFAULT_PROPERTIES, ossl_sha224_functions }, | |
255 | { PROV_NAMES_SHA2_256, FIPS_DEFAULT_PROPERTIES, ossl_sha256_functions }, | |
256 | { PROV_NAMES_SHA2_384, FIPS_DEFAULT_PROPERTIES, ossl_sha384_functions }, | |
257 | { PROV_NAMES_SHA2_512, FIPS_DEFAULT_PROPERTIES, ossl_sha512_functions }, | |
258 | { PROV_NAMES_SHA2_512_224, FIPS_DEFAULT_PROPERTIES, | |
1be63951 | 259 | ossl_sha512_224_functions }, |
e2f5df36 | 260 | { PROV_NAMES_SHA2_512_256, FIPS_DEFAULT_PROPERTIES, |
1be63951 | 261 | ossl_sha512_256_functions }, |
df553b79 RL |
262 | |
263 | /* We agree with NIST here, so one name only */ | |
e2f5df36 RL |
264 | { PROV_NAMES_SHA3_224, FIPS_DEFAULT_PROPERTIES, ossl_sha3_224_functions }, |
265 | { PROV_NAMES_SHA3_256, FIPS_DEFAULT_PROPERTIES, ossl_sha3_256_functions }, | |
266 | { PROV_NAMES_SHA3_384, FIPS_DEFAULT_PROPERTIES, ossl_sha3_384_functions }, | |
267 | { PROV_NAMES_SHA3_512, FIPS_DEFAULT_PROPERTIES, ossl_sha3_512_functions }, | |
d5e5e2ff | 268 | |
e2f5df36 RL |
269 | { PROV_NAMES_SHAKE_128, FIPS_DEFAULT_PROPERTIES, ossl_shake_128_functions }, |
270 | { PROV_NAMES_SHAKE_256, FIPS_DEFAULT_PROPERTIES, ossl_shake_256_functions }, | |
b1c21b27 P |
271 | |
272 | /* | |
273 | * KECCAK-KMAC-128 and KECCAK-KMAC-256 as hashes are mostly useful for | |
274 | * KMAC128 and KMAC256. | |
275 | */ | |
e2f5df36 | 276 | { PROV_NAMES_KECCAK_KMAC_128, FIPS_DEFAULT_PROPERTIES, |
1be63951 | 277 | ossl_keccak_kmac_128_functions }, |
e2f5df36 | 278 | { PROV_NAMES_KECCAK_KMAC_256, FIPS_DEFAULT_PROPERTIES, |
1be63951 | 279 | ossl_keccak_kmac_256_functions }, |
9efa0ae0 MC |
280 | { NULL, NULL, NULL } |
281 | }; | |
282 | ||
0d2bfe52 | 283 | static const OSSL_ALGORITHM_CAPABLE fips_ciphers[] = { |
df553b79 | 284 | /* Our primary name[:ASN.1 OID name][:our older names] */ |
e2f5df36 RL |
285 | ALG(PROV_NAMES_AES_256_ECB, ossl_aes256ecb_functions), |
286 | ALG(PROV_NAMES_AES_192_ECB, ossl_aes192ecb_functions), | |
287 | ALG(PROV_NAMES_AES_128_ECB, ossl_aes128ecb_functions), | |
288 | ALG(PROV_NAMES_AES_256_CBC, ossl_aes256cbc_functions), | |
289 | ALG(PROV_NAMES_AES_192_CBC, ossl_aes192cbc_functions), | |
290 | ALG(PROV_NAMES_AES_128_CBC, ossl_aes128cbc_functions), | |
291 | ALG(PROV_NAMES_AES_256_CBC_CTS, ossl_aes256cbc_cts_functions), | |
292 | ALG(PROV_NAMES_AES_192_CBC_CTS, ossl_aes192cbc_cts_functions), | |
293 | ALG(PROV_NAMES_AES_128_CBC_CTS, ossl_aes128cbc_cts_functions), | |
294 | ALG(PROV_NAMES_AES_256_OFB, ossl_aes256ofb_functions), | |
295 | ALG(PROV_NAMES_AES_192_OFB, ossl_aes192ofb_functions), | |
296 | ALG(PROV_NAMES_AES_128_OFB, ossl_aes128ofb_functions), | |
297 | ALG(PROV_NAMES_AES_256_CFB, ossl_aes256cfb_functions), | |
298 | ALG(PROV_NAMES_AES_192_CFB, ossl_aes192cfb_functions), | |
299 | ALG(PROV_NAMES_AES_128_CFB, ossl_aes128cfb_functions), | |
300 | ALG(PROV_NAMES_AES_256_CFB1, ossl_aes256cfb1_functions), | |
301 | ALG(PROV_NAMES_AES_192_CFB1, ossl_aes192cfb1_functions), | |
302 | ALG(PROV_NAMES_AES_128_CFB1, ossl_aes128cfb1_functions), | |
303 | ALG(PROV_NAMES_AES_256_CFB8, ossl_aes256cfb8_functions), | |
304 | ALG(PROV_NAMES_AES_192_CFB8, ossl_aes192cfb8_functions), | |
305 | ALG(PROV_NAMES_AES_128_CFB8, ossl_aes128cfb8_functions), | |
306 | ALG(PROV_NAMES_AES_256_CTR, ossl_aes256ctr_functions), | |
307 | ALG(PROV_NAMES_AES_192_CTR, ossl_aes192ctr_functions), | |
308 | ALG(PROV_NAMES_AES_128_CTR, ossl_aes128ctr_functions), | |
309 | ALG(PROV_NAMES_AES_256_XTS, ossl_aes256xts_functions), | |
310 | ALG(PROV_NAMES_AES_128_XTS, ossl_aes128xts_functions), | |
311 | ALG(PROV_NAMES_AES_256_GCM, ossl_aes256gcm_functions), | |
312 | ALG(PROV_NAMES_AES_192_GCM, ossl_aes192gcm_functions), | |
313 | ALG(PROV_NAMES_AES_128_GCM, ossl_aes128gcm_functions), | |
314 | ALG(PROV_NAMES_AES_256_CCM, ossl_aes256ccm_functions), | |
315 | ALG(PROV_NAMES_AES_192_CCM, ossl_aes192ccm_functions), | |
316 | ALG(PROV_NAMES_AES_128_CCM, ossl_aes128ccm_functions), | |
317 | ALG(PROV_NAMES_AES_256_WRAP, ossl_aes256wrap_functions), | |
318 | ALG(PROV_NAMES_AES_192_WRAP, ossl_aes192wrap_functions), | |
319 | ALG(PROV_NAMES_AES_128_WRAP, ossl_aes128wrap_functions), | |
320 | ALG(PROV_NAMES_AES_256_WRAP_PAD, ossl_aes256wrappad_functions), | |
321 | ALG(PROV_NAMES_AES_192_WRAP_PAD, ossl_aes192wrappad_functions), | |
322 | ALG(PROV_NAMES_AES_128_WRAP_PAD, ossl_aes128wrappad_functions), | |
323 | ALG(PROV_NAMES_AES_256_WRAP_INV, ossl_aes256wrapinv_functions), | |
324 | ALG(PROV_NAMES_AES_192_WRAP_INV, ossl_aes192wrapinv_functions), | |
325 | ALG(PROV_NAMES_AES_128_WRAP_INV, ossl_aes128wrapinv_functions), | |
326 | ALG(PROV_NAMES_AES_256_WRAP_PAD_INV, ossl_aes256wrappadinv_functions), | |
327 | ALG(PROV_NAMES_AES_192_WRAP_PAD_INV, ossl_aes192wrappadinv_functions), | |
328 | ALG(PROV_NAMES_AES_128_WRAP_PAD_INV, ossl_aes128wrappadinv_functions), | |
329 | ALGC(PROV_NAMES_AES_128_CBC_HMAC_SHA1, ossl_aes128cbc_hmac_sha1_functions, | |
592dcfd3 | 330 | ossl_cipher_capable_aes_cbc_hmac_sha1), |
e2f5df36 | 331 | ALGC(PROV_NAMES_AES_256_CBC_HMAC_SHA1, ossl_aes256cbc_hmac_sha1_functions, |
592dcfd3 | 332 | ossl_cipher_capable_aes_cbc_hmac_sha1), |
e2f5df36 | 333 | ALGC(PROV_NAMES_AES_128_CBC_HMAC_SHA256, ossl_aes128cbc_hmac_sha256_functions, |
592dcfd3 | 334 | ossl_cipher_capable_aes_cbc_hmac_sha256), |
e2f5df36 | 335 | ALGC(PROV_NAMES_AES_256_CBC_HMAC_SHA256, ossl_aes256cbc_hmac_sha256_functions, |
592dcfd3 | 336 | ossl_cipher_capable_aes_cbc_hmac_sha256), |
cb1548bc | 337 | #ifndef OPENSSL_NO_DES |
e2f5df36 RL |
338 | ALG(PROV_NAMES_DES_EDE3_ECB, ossl_tdes_ede3_ecb_functions), |
339 | ALG(PROV_NAMES_DES_EDE3_CBC, ossl_tdes_ede3_cbc_functions), | |
cb1548bc | 340 | #endif /* OPENSSL_NO_DES */ |
0d2bfe52 | 341 | { { NULL, NULL, NULL }, NULL } |
66ad63e8 | 342 | }; |
0d2bfe52 | 343 | static OSSL_ALGORITHM exported_fips_ciphers[OSSL_NELEM(fips_ciphers)]; |
66ad63e8 | 344 | |
2e5db6ad | 345 | static const OSSL_ALGORITHM fips_macs[] = { |
b1c21b27 | 346 | #ifndef OPENSSL_NO_CMAC |
e2f5df36 | 347 | { PROV_NAMES_CMAC, FIPS_DEFAULT_PROPERTIES, ossl_cmac_functions }, |
b1c21b27 | 348 | #endif |
e2f5df36 RL |
349 | { PROV_NAMES_GMAC, FIPS_DEFAULT_PROPERTIES, ossl_gmac_functions }, |
350 | { PROV_NAMES_HMAC, FIPS_DEFAULT_PROPERTIES, ossl_hmac_functions }, | |
351 | { PROV_NAMES_KMAC_128, FIPS_DEFAULT_PROPERTIES, ossl_kmac128_functions }, | |
352 | { PROV_NAMES_KMAC_256, FIPS_DEFAULT_PROPERTIES, ossl_kmac256_functions }, | |
2e5db6ad RL |
353 | { NULL, NULL, NULL } |
354 | }; | |
355 | ||
e3405a4a | 356 | static const OSSL_ALGORITHM fips_kdfs[] = { |
e2f5df36 | 357 | { PROV_NAMES_HKDF, FIPS_DEFAULT_PROPERTIES, ossl_kdf_hkdf_functions }, |
736dba01 P |
358 | { PROV_NAMES_TLS1_3_KDF, FIPS_DEFAULT_PROPERTIES, |
359 | ossl_kdf_tls1_3_kdf_functions }, | |
e2f5df36 RL |
360 | { PROV_NAMES_SSKDF, FIPS_DEFAULT_PROPERTIES, ossl_kdf_sskdf_functions }, |
361 | { PROV_NAMES_PBKDF2, FIPS_DEFAULT_PROPERTIES, ossl_kdf_pbkdf2_functions }, | |
362 | { PROV_NAMES_SSHKDF, FIPS_DEFAULT_PROPERTIES, ossl_kdf_sshkdf_functions }, | |
363 | { PROV_NAMES_X963KDF, FIPS_DEFAULT_PROPERTIES, | |
89cccbea | 364 | ossl_kdf_x963_kdf_functions }, |
e2f5df36 | 365 | { PROV_NAMES_X942KDF_ASN1, FIPS_DEFAULT_PROPERTIES, |
89cccbea | 366 | ossl_kdf_x942_kdf_functions }, |
e2f5df36 RL |
367 | { PROV_NAMES_TLS1_PRF, FIPS_DEFAULT_PROPERTIES, |
368 | ossl_kdf_tls1_prf_functions }, | |
369 | { PROV_NAMES_KBKDF, FIPS_DEFAULT_PROPERTIES, ossl_kdf_kbkdf_functions }, | |
df553b79 | 370 | { NULL, NULL, NULL } |
e3405a4a P |
371 | }; |
372 | ||
bcc4ae67 | 373 | static const OSSL_ALGORITHM fips_rands[] = { |
e2f5df36 RL |
374 | { PROV_NAMES_CTR_DRBG, FIPS_DEFAULT_PROPERTIES, ossl_drbg_ctr_functions }, |
375 | { PROV_NAMES_HASH_DRBG, FIPS_DEFAULT_PROPERTIES, ossl_drbg_hash_functions }, | |
376 | { PROV_NAMES_HMAC_DRBG, FIPS_DEFAULT_PROPERTIES, ossl_drbg_ossl_hmac_functions }, | |
377 | { PROV_NAMES_TEST_RAND, FIPS_UNAPPROVED_PROPERTIES, ossl_test_rng_functions }, | |
bcc4ae67 P |
378 | { NULL, NULL, NULL } |
379 | }; | |
380 | ||
62f49b90 SL |
381 | static const OSSL_ALGORITHM fips_keyexch[] = { |
382 | #ifndef OPENSSL_NO_DH | |
e2f5df36 | 383 | { PROV_NAMES_DH, FIPS_DEFAULT_PROPERTIES, ossl_dh_keyexch_functions }, |
1c725f46 SL |
384 | #endif |
385 | #ifndef OPENSSL_NO_EC | |
e2f5df36 RL |
386 | { PROV_NAMES_ECDH, FIPS_DEFAULT_PROPERTIES, ossl_ecdh_keyexch_functions }, |
387 | { PROV_NAMES_X25519, FIPS_DEFAULT_PROPERTIES, ossl_x25519_keyexch_functions }, | |
388 | { PROV_NAMES_X448, FIPS_DEFAULT_PROPERTIES, ossl_x448_keyexch_functions }, | |
62f49b90 | 389 | #endif |
e2f5df36 | 390 | { PROV_NAMES_TLS1_PRF, FIPS_DEFAULT_PROPERTIES, |
1be63951 | 391 | ossl_kdf_tls1_prf_keyexch_functions }, |
e2f5df36 | 392 | { PROV_NAMES_HKDF, FIPS_DEFAULT_PROPERTIES, ossl_kdf_hkdf_keyexch_functions }, |
62f49b90 SL |
393 | { NULL, NULL, NULL } |
394 | }; | |
395 | ||
e683582b SL |
396 | static const OSSL_ALGORITHM fips_signature[] = { |
397 | #ifndef OPENSSL_NO_DSA | |
e2f5df36 | 398 | { PROV_NAMES_DSA, FIPS_DEFAULT_PROPERTIES, ossl_dsa_signature_functions }, |
e683582b | 399 | #endif |
e2f5df36 | 400 | { PROV_NAMES_RSA, FIPS_DEFAULT_PROPERTIES, ossl_rsa_signature_functions }, |
edd3b7a3 | 401 | #ifndef OPENSSL_NO_EC |
e2f5df36 RL |
402 | { PROV_NAMES_ED25519, FIPS_DEFAULT_PROPERTIES, ossl_ed25519_signature_functions }, |
403 | { PROV_NAMES_ED448, FIPS_DEFAULT_PROPERTIES, ossl_ed448_signature_functions }, | |
404 | { PROV_NAMES_ECDSA, FIPS_DEFAULT_PROPERTIES, ossl_ecdsa_signature_functions }, | |
edd3b7a3 | 405 | #endif |
e2f5df36 | 406 | { PROV_NAMES_HMAC, FIPS_DEFAULT_PROPERTIES, |
1be63951 | 407 | ossl_mac_legacy_hmac_signature_functions }, |
a540ef90 | 408 | #ifndef OPENSSL_NO_CMAC |
e2f5df36 | 409 | { PROV_NAMES_CMAC, FIPS_DEFAULT_PROPERTIES, |
1be63951 | 410 | ossl_mac_legacy_cmac_signature_functions }, |
a540ef90 | 411 | #endif |
e683582b SL |
412 | { NULL, NULL, NULL } |
413 | }; | |
414 | ||
afb638f1 | 415 | static const OSSL_ALGORITHM fips_asym_cipher[] = { |
e2f5df36 | 416 | { PROV_NAMES_RSA, FIPS_DEFAULT_PROPERTIES, ossl_rsa_asym_cipher_functions }, |
afb638f1 MC |
417 | { NULL, NULL, NULL } |
418 | }; | |
419 | ||
80f4fd18 | 420 | static const OSSL_ALGORITHM fips_asym_kem[] = { |
e2f5df36 | 421 | { PROV_NAMES_RSA, FIPS_DEFAULT_PROPERTIES, ossl_rsa_asym_kem_functions }, |
80f4fd18 SL |
422 | { NULL, NULL, NULL } |
423 | }; | |
424 | ||
e683582b | 425 | static const OSSL_ALGORITHM fips_keymgmt[] = { |
62f49b90 | 426 | #ifndef OPENSSL_NO_DH |
e2f5df36 RL |
427 | { PROV_NAMES_DH, FIPS_DEFAULT_PROPERTIES, ossl_dh_keymgmt_functions, |
428 | PROV_DESCS_DH }, | |
429 | { PROV_NAMES_DHX, FIPS_DEFAULT_PROPERTIES, ossl_dhx_keymgmt_functions, | |
430 | PROV_DESCS_DHX }, | |
62f49b90 | 431 | #endif |
e683582b | 432 | #ifndef OPENSSL_NO_DSA |
e2f5df36 RL |
433 | { PROV_NAMES_DSA, FIPS_DEFAULT_PROPERTIES, ossl_dsa_keymgmt_functions, |
434 | PROV_DESCS_DSA }, | |
e683582b | 435 | #endif |
e2f5df36 RL |
436 | { PROV_NAMES_RSA, FIPS_DEFAULT_PROPERTIES, ossl_rsa_keymgmt_functions, |
437 | PROV_DESCS_RSA }, | |
438 | { PROV_NAMES_RSA_PSS, FIPS_DEFAULT_PROPERTIES, | |
439 | ossl_rsapss_keymgmt_functions, PROV_DESCS_RSA_PSS }, | |
1c725f46 | 440 | #ifndef OPENSSL_NO_EC |
e2f5df36 RL |
441 | { PROV_NAMES_EC, FIPS_DEFAULT_PROPERTIES, ossl_ec_keymgmt_functions, |
442 | PROV_DESCS_EC }, | |
443 | { PROV_NAMES_X25519, FIPS_DEFAULT_PROPERTIES, ossl_x25519_keymgmt_functions, | |
444 | PROV_DESCS_X25519 }, | |
445 | { PROV_NAMES_X448, FIPS_DEFAULT_PROPERTIES, ossl_x448_keymgmt_functions, | |
446 | PROV_DESCS_X448 }, | |
447 | { PROV_NAMES_ED25519, FIPS_DEFAULT_PROPERTIES, ossl_ed25519_keymgmt_functions, | |
448 | PROV_DESCS_ED25519 }, | |
449 | { PROV_NAMES_ED448, FIPS_DEFAULT_PROPERTIES, ossl_ed448_keymgmt_functions, | |
450 | PROV_DESCS_ED448 }, | |
1c725f46 | 451 | #endif |
e2f5df36 RL |
452 | { PROV_NAMES_TLS1_PRF, FIPS_DEFAULT_PROPERTIES, ossl_kdf_keymgmt_functions, |
453 | PROV_DESCS_TLS1_PRF_SIGN }, | |
454 | { PROV_NAMES_HKDF, FIPS_DEFAULT_PROPERTIES, ossl_kdf_keymgmt_functions, | |
455 | PROV_DESCS_HKDF_SIGN }, | |
456 | { PROV_NAMES_HMAC, FIPS_DEFAULT_PROPERTIES, ossl_mac_legacy_keymgmt_functions, | |
457 | PROV_DESCS_HMAC_SIGN }, | |
a540ef90 | 458 | #ifndef OPENSSL_NO_CMAC |
e2f5df36 RL |
459 | { PROV_NAMES_CMAC, FIPS_DEFAULT_PROPERTIES, |
460 | ossl_cmac_legacy_keymgmt_functions, PROV_DESCS_CMAC_SIGN }, | |
a540ef90 | 461 | #endif |
e683582b SL |
462 | { NULL, NULL, NULL } |
463 | }; | |
0d2bfe52 | 464 | |
fdaad3f1 RL |
465 | static const OSSL_ALGORITHM *fips_query(void *provctx, int operation_id, |
466 | int *no_cache) | |
9efa0ae0 MC |
467 | { |
468 | *no_cache = 0; | |
04cb5ec0 | 469 | |
6cf37302 | 470 | if (!ossl_prov_is_running()) |
04cb5ec0 SL |
471 | return NULL; |
472 | ||
9efa0ae0 MC |
473 | switch (operation_id) { |
474 | case OSSL_OP_DIGEST: | |
475 | return fips_digests; | |
66ad63e8 | 476 | case OSSL_OP_CIPHER: |
0d2bfe52 | 477 | return exported_fips_ciphers; |
2e5db6ad RL |
478 | case OSSL_OP_MAC: |
479 | return fips_macs; | |
e3405a4a P |
480 | case OSSL_OP_KDF: |
481 | return fips_kdfs; | |
bcc4ae67 P |
482 | case OSSL_OP_RAND: |
483 | return fips_rands; | |
e683582b SL |
484 | case OSSL_OP_KEYMGMT: |
485 | return fips_keymgmt; | |
62f49b90 SL |
486 | case OSSL_OP_KEYEXCH: |
487 | return fips_keyexch; | |
e683582b SL |
488 | case OSSL_OP_SIGNATURE: |
489 | return fips_signature; | |
afb638f1 MC |
490 | case OSSL_OP_ASYM_CIPHER: |
491 | return fips_asym_cipher; | |
80f4fd18 SL |
492 | case OSSL_OP_KEM: |
493 | return fips_asym_kem; | |
9efa0ae0 MC |
494 | } |
495 | return NULL; | |
496 | } | |
497 | ||
c5e7de5d DB |
498 | void *ossl_c_locale() { |
499 | return (void *)loc; | |
500 | } | |
501 | ||
502 | static int fips_init_casecmp(void) { | |
503 | # ifdef OPENSSL_SYS_WINDOWS | |
504 | loc = _create_locale(LC_COLLATE, "C"); | |
505 | # else | |
506 | loc = newlocale(LC_COLLATE_MASK, "C", (locale_t) 0); | |
507 | # endif | |
508 | return (loc == (locale_t) 0) ? 0 : 1; | |
509 | } | |
510 | ||
511 | static void fips_deinit_casecmp(void) { | |
512 | freelocale(loc); | |
513 | } | |
514 | ||
fdaad3f1 RL |
515 | static void fips_teardown(void *provctx) |
516 | { | |
a829b735 | 517 | OSSL_LIB_CTX_free(PROV_LIBCTX_OF(provctx)); |
7d6766cb | 518 | ossl_prov_ctx_free(provctx); |
78906fff RL |
519 | } |
520 | ||
521 | static void fips_intern_teardown(void *provctx) | |
522 | { | |
523 | /* | |
524 | * We know that the library context is the same as for the outer provider, | |
525 | * so no need to destroy it here. | |
526 | */ | |
c5e7de5d | 527 | fips_deinit_casecmp(); |
7d6766cb | 528 | ossl_prov_ctx_free(provctx); |
fdaad3f1 RL |
529 | } |
530 | ||
9efa0ae0 MC |
531 | /* Functions we provide to the core */ |
532 | static const OSSL_DISPATCH fips_dispatch_table[] = { | |
fdaad3f1 | 533 | { OSSL_FUNC_PROVIDER_TEARDOWN, (void (*)(void))fips_teardown }, |
dca97d00 | 534 | { OSSL_FUNC_PROVIDER_GETTABLE_PARAMS, (void (*)(void))fips_gettable_params }, |
9efa0ae0 MC |
535 | { OSSL_FUNC_PROVIDER_GET_PARAMS, (void (*)(void))fips_get_params }, |
536 | { OSSL_FUNC_PROVIDER_QUERY_OPERATION, (void (*)(void))fips_query }, | |
04cb5ec0 | 537 | { OSSL_FUNC_PROVIDER_GET_CAPABILITIES, |
c8830891 | 538 | (void (*)(void))ossl_prov_get_capabilities }, |
04cb5ec0 | 539 | { OSSL_FUNC_PROVIDER_SELF_TEST, (void (*)(void))fips_self_test }, |
9efa0ae0 MC |
540 | { 0, NULL } |
541 | }; | |
542 | ||
319e518a MC |
543 | /* Functions we provide to ourself */ |
544 | static const OSSL_DISPATCH intern_dispatch_table[] = { | |
78906fff | 545 | { OSSL_FUNC_PROVIDER_TEARDOWN, (void (*)(void))fips_intern_teardown }, |
319e518a MC |
546 | { OSSL_FUNC_PROVIDER_QUERY_OPERATION, (void (*)(void))fips_query }, |
547 | { 0, NULL } | |
548 | }; | |
549 | ||
b9385449 RL |
550 | /* |
551 | * On VMS, the provider init function name is expected to be uppercase, | |
552 | * see the pragmas in <openssl/core.h>. Let's do the same with this | |
553 | * internal name. This is how symbol names are treated by default | |
554 | * by the compiler if nothing else is said, but since this is part | |
555 | * of libfips, and we build our libraries with mixed case symbol names, | |
556 | * we must switch back to this default explicitly here. | |
557 | */ | |
558 | #ifdef __VMS | |
559 | # pragma names save | |
560 | # pragma names uppercase,truncated | |
561 | #endif | |
562 | OSSL_provider_init_fn OSSL_provider_init_int; | |
563 | #ifdef __VMS | |
564 | # pragma names restore | |
565 | #endif | |
566 | int OSSL_provider_init_int(const OSSL_CORE_HANDLE *handle, | |
567 | const OSSL_DISPATCH *in, | |
568 | const OSSL_DISPATCH **out, | |
569 | void **provctx) | |
9efa0ae0 | 570 | { |
da747958 | 571 | FIPS_GLOBAL *fgbl; |
b4250010 | 572 | OSSL_LIB_CTX *libctx = NULL; |
6ce58488 MC |
573 | SELF_TEST_POST_PARAMS selftest_params; |
574 | ||
575 | memset(&selftest_params, 0, sizeof(selftest_params)); | |
319e518a | 576 | |
c5e7de5d DB |
577 | if (!fips_init_casecmp()) |
578 | return 0; | |
08edd447 P |
579 | if (!ossl_prov_seeding_from_dispatch(in)) |
580 | return 0; | |
9efa0ae0 | 581 | for (; in->function_id != 0; in++) { |
7b9f0279 MC |
582 | /* |
583 | * We do not support the scenario of an application linked against | |
584 | * multiple versions of libcrypto (e.g. one static and one dynamic), but | |
585 | * sharing a single fips.so. We do a simple sanity check here. | |
586 | */ | |
587 | #define set_func(c, f) if (c == NULL) c = f; else if (c != f) return 0; | |
9efa0ae0 | 588 | switch (in->function_id) { |
a829b735 | 589 | case OSSL_FUNC_CORE_GET_LIBCTX: |
7b9f0279 | 590 | set_func(c_get_libctx, OSSL_FUNC_core_get_libctx(in)); |
36fc5fc6 | 591 | break; |
dca97d00 | 592 | case OSSL_FUNC_CORE_GETTABLE_PARAMS: |
7b9f0279 | 593 | set_func(c_gettable_params, OSSL_FUNC_core_gettable_params(in)); |
9efa0ae0 MC |
594 | break; |
595 | case OSSL_FUNC_CORE_GET_PARAMS: | |
7b9f0279 | 596 | set_func(c_get_params, OSSL_FUNC_core_get_params(in)); |
9efa0ae0 | 597 | break; |
da747958 | 598 | case OSSL_FUNC_CORE_THREAD_START: |
7b9f0279 | 599 | set_func(c_thread_start, OSSL_FUNC_core_thread_start(in)); |
da747958 | 600 | break; |
036913b1 | 601 | case OSSL_FUNC_CORE_NEW_ERROR: |
7b9f0279 | 602 | set_func(c_new_error, OSSL_FUNC_core_new_error(in)); |
3593266d | 603 | break; |
036913b1 | 604 | case OSSL_FUNC_CORE_SET_ERROR_DEBUG: |
7b9f0279 | 605 | set_func(c_set_error_debug, OSSL_FUNC_core_set_error_debug(in)); |
036913b1 RL |
606 | break; |
607 | case OSSL_FUNC_CORE_VSET_ERROR: | |
7b9f0279 | 608 | set_func(c_vset_error, OSSL_FUNC_core_vset_error(in)); |
3593266d | 609 | break; |
7b131de2 | 610 | case OSSL_FUNC_CORE_SET_ERROR_MARK: |
7b9f0279 | 611 | set_func(c_set_error_mark, OSSL_FUNC_core_set_error_mark(in)); |
7b131de2 RL |
612 | break; |
613 | case OSSL_FUNC_CORE_CLEAR_LAST_ERROR_MARK: | |
7b9f0279 MC |
614 | set_func(c_clear_last_error_mark, |
615 | OSSL_FUNC_core_clear_last_error_mark(in)); | |
7b131de2 RL |
616 | break; |
617 | case OSSL_FUNC_CORE_POP_ERROR_TO_MARK: | |
7b9f0279 | 618 | set_func(c_pop_error_to_mark, OSSL_FUNC_core_pop_error_to_mark(in)); |
7b131de2 | 619 | break; |
b60cba3c | 620 | case OSSL_FUNC_CRYPTO_MALLOC: |
7b9f0279 | 621 | set_func(c_CRYPTO_malloc, OSSL_FUNC_CRYPTO_malloc(in)); |
b60cba3c RS |
622 | break; |
623 | case OSSL_FUNC_CRYPTO_ZALLOC: | |
7b9f0279 | 624 | set_func(c_CRYPTO_zalloc, OSSL_FUNC_CRYPTO_zalloc(in)); |
b60cba3c | 625 | break; |
b60cba3c | 626 | case OSSL_FUNC_CRYPTO_FREE: |
7b9f0279 | 627 | set_func(c_CRYPTO_free, OSSL_FUNC_CRYPTO_free(in)); |
b60cba3c RS |
628 | break; |
629 | case OSSL_FUNC_CRYPTO_CLEAR_FREE: | |
7b9f0279 | 630 | set_func(c_CRYPTO_clear_free, OSSL_FUNC_CRYPTO_clear_free(in)); |
b60cba3c RS |
631 | break; |
632 | case OSSL_FUNC_CRYPTO_REALLOC: | |
7b9f0279 | 633 | set_func(c_CRYPTO_realloc, OSSL_FUNC_CRYPTO_realloc(in)); |
b60cba3c RS |
634 | break; |
635 | case OSSL_FUNC_CRYPTO_CLEAR_REALLOC: | |
7b9f0279 MC |
636 | set_func(c_CRYPTO_clear_realloc, |
637 | OSSL_FUNC_CRYPTO_clear_realloc(in)); | |
b60cba3c RS |
638 | break; |
639 | case OSSL_FUNC_CRYPTO_SECURE_MALLOC: | |
7b9f0279 MC |
640 | set_func(c_CRYPTO_secure_malloc, |
641 | OSSL_FUNC_CRYPTO_secure_malloc(in)); | |
b60cba3c RS |
642 | break; |
643 | case OSSL_FUNC_CRYPTO_SECURE_ZALLOC: | |
7b9f0279 MC |
644 | set_func(c_CRYPTO_secure_zalloc, |
645 | OSSL_FUNC_CRYPTO_secure_zalloc(in)); | |
b60cba3c RS |
646 | break; |
647 | case OSSL_FUNC_CRYPTO_SECURE_FREE: | |
7b9f0279 MC |
648 | set_func(c_CRYPTO_secure_free, |
649 | OSSL_FUNC_CRYPTO_secure_free(in)); | |
b60cba3c RS |
650 | break; |
651 | case OSSL_FUNC_CRYPTO_SECURE_CLEAR_FREE: | |
7b9f0279 MC |
652 | set_func(c_CRYPTO_secure_clear_free, |
653 | OSSL_FUNC_CRYPTO_secure_clear_free(in)); | |
b60cba3c RS |
654 | break; |
655 | case OSSL_FUNC_CRYPTO_SECURE_ALLOCATED: | |
7b9f0279 MC |
656 | set_func(c_CRYPTO_secure_allocated, |
657 | OSSL_FUNC_CRYPTO_secure_allocated(in)); | |
b60cba3c | 658 | break; |
25e60144 | 659 | case OSSL_FUNC_BIO_NEW_FILE: |
7b9f0279 MC |
660 | set_func(selftest_params.bio_new_file_cb, |
661 | OSSL_FUNC_BIO_new_file(in)); | |
25e60144 SL |
662 | break; |
663 | case OSSL_FUNC_BIO_NEW_MEMBUF: | |
7b9f0279 MC |
664 | set_func(selftest_params.bio_new_buffer_cb, |
665 | OSSL_FUNC_BIO_new_membuf(in)); | |
25e60144 | 666 | break; |
7bb82f92 | 667 | case OSSL_FUNC_BIO_READ_EX: |
7b9f0279 MC |
668 | set_func(selftest_params.bio_read_ex_cb, |
669 | OSSL_FUNC_BIO_read_ex(in)); | |
25e60144 SL |
670 | break; |
671 | case OSSL_FUNC_BIO_FREE: | |
7b9f0279 | 672 | set_func(selftest_params.bio_free_cb, OSSL_FUNC_BIO_free(in)); |
25e60144 | 673 | break; |
d16d0b71 | 674 | case OSSL_FUNC_BIO_VSNPRINTF: |
7b9f0279 | 675 | set_func(c_BIO_vsnprintf, OSSL_FUNC_BIO_vsnprintf(in)); |
d16d0b71 | 676 | break; |
08edd447 | 677 | case OSSL_FUNC_SELF_TEST_CB: |
7b9f0279 | 678 | set_func(c_stcbfn, OSSL_FUNC_self_test_cb(in)); |
36fc5fc6 | 679 | break; |
9efa0ae0 | 680 | default: |
b60cba3c | 681 | /* Just ignore anything we don't understand */ |
9efa0ae0 MC |
682 | break; |
683 | } | |
684 | } | |
685 | ||
b60cba3c | 686 | /* Create a context. */ |
7d6766cb | 687 | if ((*provctx = ossl_prov_ctx_new()) == NULL |
b4250010 | 688 | || (libctx = OSSL_LIB_CTX_new()) == NULL) { |
78906fff RL |
689 | /* |
690 | * We free libctx separately here and only here because it hasn't | |
691 | * been attached to *provctx. All other error paths below rely | |
692 | * solely on fips_teardown. | |
693 | */ | |
b4250010 | 694 | OSSL_LIB_CTX_free(libctx); |
78906fff RL |
695 | goto err; |
696 | } | |
fdaad3f1 | 697 | |
927d0566 | 698 | if ((fgbl = ossl_lib_ctx_get_data(libctx, OSSL_LIB_CTX_FIPS_PROV_INDEX)) == NULL) |
fdaad3f1 | 699 | goto err; |
7bb82f92 | 700 | |
d40b42ab | 701 | fgbl->handle = handle; |
7bb82f92 | 702 | |
6ce58488 MC |
703 | /* |
704 | * We did initial set up of selftest_params in a local copy, because we | |
705 | * could not create fgbl until c_CRYPTO_zalloc was defined in the loop | |
706 | * above. | |
707 | */ | |
708 | fgbl->selftest_params = selftest_params; | |
709 | ||
710 | fgbl->selftest_params.libctx = libctx; | |
711 | ||
712 | set_self_test_cb(fgbl); | |
713 | ||
714 | if (!fips_get_params_from_core(fgbl)) { | |
715 | /* Error already raised */ | |
dea76175 | 716 | goto err; |
6ce58488 MC |
717 | } |
718 | /* | |
6d418dbc DB |
719 | * Disable the conditional error check if it's disabled in the fips config |
720 | * file. | |
6ce58488 MC |
721 | */ |
722 | if (fgbl->selftest_params.conditional_error_check != NULL | |
723 | && strcmp(fgbl->selftest_params.conditional_error_check, "0") == 0) | |
724 | SELF_TEST_disable_conditional_error_state(); | |
725 | ||
6d418dbc | 726 | /* Disable the security check if it's disabled in the fips config file. */ |
6ce58488 MC |
727 | if (fgbl->fips_security_check_option != NULL |
728 | && strcmp(fgbl->fips_security_check_option, "0") == 0) | |
729 | fgbl->fips_security_checks = 0; | |
730 | ||
b233ea82 MC |
731 | ossl_prov_cache_exported_algorithms(fips_ciphers, exported_fips_ciphers); |
732 | ||
6ce58488 | 733 | if (!SELF_TEST_post(&fgbl->selftest_params, 0)) { |
9f7bdcf3 | 734 | ERR_raise(ERR_LIB_PROV, PROV_R_SELF_TEST_POST_FAILURE); |
fdaad3f1 | 735 | goto err; |
9f7bdcf3 | 736 | } |
7bb82f92 | 737 | |
43dbe3b7 P |
738 | ossl_prov_ctx_set0_libctx(*provctx, libctx); |
739 | ossl_prov_ctx_set0_handle(*provctx, handle); | |
740 | ||
e683582b | 741 | *out = fips_dispatch_table; |
9efa0ae0 | 742 | return 1; |
fdaad3f1 RL |
743 | err: |
744 | fips_teardown(*provctx); | |
09f38299 | 745 | OSSL_LIB_CTX_free(libctx); |
fdaad3f1 RL |
746 | *provctx = NULL; |
747 | return 0; | |
9efa0ae0 | 748 | } |
3593266d | 749 | |
319e518a MC |
750 | /* |
751 | * The internal init function used when the FIPS module uses EVP to call | |
b1eb3fd7 | 752 | * another algorithm also in the FIPS module. This is a recursive call that has |
bb751e11 RL |
753 | * been made from within the FIPS module itself. To make this work, we populate |
754 | * the provider context of this inner instance with the same library context | |
755 | * that was used in the EVP call that initiated this recursive call. | |
319e518a | 756 | */ |
c8830891 SL |
757 | OSSL_provider_init_fn ossl_fips_intern_provider_init; |
758 | int ossl_fips_intern_provider_init(const OSSL_CORE_HANDLE *handle, | |
759 | const OSSL_DISPATCH *in, | |
760 | const OSSL_DISPATCH **out, | |
761 | void **provctx) | |
3593266d | 762 | { |
a829b735 | 763 | OSSL_FUNC_core_get_libctx_fn *c_internal_get_libctx = NULL; |
bb751e11 RL |
764 | |
765 | for (; in->function_id != 0; in++) { | |
766 | switch (in->function_id) { | |
a829b735 DMSP |
767 | case OSSL_FUNC_CORE_GET_LIBCTX: |
768 | c_internal_get_libctx = OSSL_FUNC_core_get_libctx(in); | |
bb751e11 RL |
769 | break; |
770 | default: | |
771 | break; | |
772 | } | |
773 | } | |
774 | ||
04cb5ec0 | 775 | if (c_internal_get_libctx == NULL) |
bb751e11 RL |
776 | return 0; |
777 | ||
7d6766cb | 778 | if ((*provctx = ossl_prov_ctx_new()) == NULL) |
bb751e11 | 779 | return 0; |
04cb5ec0 | 780 | |
d40b42ab MC |
781 | /* |
782 | * Using the parent library context only works because we are a built-in | |
783 | * internal provider. This is not something that most providers would be | |
784 | * able to do. | |
785 | */ | |
a829b735 DMSP |
786 | ossl_prov_ctx_set0_libctx(*provctx, |
787 | (OSSL_LIB_CTX *)c_internal_get_libctx(handle)); | |
7d6766cb | 788 | ossl_prov_ctx_set0_handle(*provctx, handle); |
bb751e11 | 789 | |
319e518a | 790 | *out = intern_dispatch_table; |
3593266d MC |
791 | return 1; |
792 | } | |
793 | ||
036913b1 | 794 | void ERR_new(void) |
3593266d | 795 | { |
036913b1 RL |
796 | c_new_error(NULL); |
797 | } | |
798 | ||
799 | void ERR_set_debug(const char *file, int line, const char *func) | |
800 | { | |
801 | c_set_error_debug(NULL, file, line, func); | |
3593266d MC |
802 | } |
803 | ||
036913b1 | 804 | void ERR_set_error(int lib, int reason, const char *fmt, ...) |
3593266d MC |
805 | { |
806 | va_list args; | |
8908d18c | 807 | |
036913b1 RL |
808 | va_start(args, fmt); |
809 | c_vset_error(NULL, ERR_PACK(lib, 0, reason), fmt, args); | |
3593266d MC |
810 | va_end(args); |
811 | } | |
812 | ||
036913b1 | 813 | void ERR_vset_error(int lib, int reason, const char *fmt, va_list args) |
3593266d | 814 | { |
036913b1 | 815 | c_vset_error(NULL, ERR_PACK(lib, 0, reason), fmt, args); |
3593266d | 816 | } |
da747958 | 817 | |
7b131de2 RL |
818 | int ERR_set_mark(void) |
819 | { | |
820 | return c_set_error_mark(NULL); | |
821 | } | |
822 | ||
823 | int ERR_clear_last_mark(void) | |
824 | { | |
825 | return c_clear_last_error_mark(NULL); | |
826 | } | |
827 | ||
828 | int ERR_pop_to_mark(void) | |
829 | { | |
830 | return c_pop_error_to_mark(NULL); | |
831 | } | |
832 | ||
fdaad3f1 RL |
833 | /* |
834 | * This must take a library context, since it's called from the depths | |
835 | * of crypto/initthread.c code, where it's (correctly) assumed that the | |
b4250010 | 836 | * passed caller argument is an OSSL_LIB_CTX pointer (since the same routine |
fdaad3f1 | 837 | * is also called from other parts of libcrypto, which all pass around a |
b4250010 | 838 | * OSSL_LIB_CTX pointer) |
fdaad3f1 | 839 | */ |
b4250010 | 840 | const OSSL_CORE_HANDLE *FIPS_get_core_handle(OSSL_LIB_CTX *libctx) |
da747958 | 841 | { |
b4250010 | 842 | FIPS_GLOBAL *fgbl = ossl_lib_ctx_get_data(libctx, |
927d0566 | 843 | OSSL_LIB_CTX_FIPS_PROV_INDEX); |
da747958 MC |
844 | |
845 | if (fgbl == NULL) | |
846 | return NULL; | |
847 | ||
d40b42ab | 848 | return fgbl->handle; |
da747958 | 849 | } |
b60cba3c RS |
850 | |
851 | void *CRYPTO_malloc(size_t num, const char *file, int line) | |
852 | { | |
853 | return c_CRYPTO_malloc(num, file, line); | |
854 | } | |
855 | ||
856 | void *CRYPTO_zalloc(size_t num, const char *file, int line) | |
857 | { | |
858 | return c_CRYPTO_zalloc(num, file, line); | |
859 | } | |
860 | ||
b60cba3c RS |
861 | void CRYPTO_free(void *ptr, const char *file, int line) |
862 | { | |
863 | c_CRYPTO_free(ptr, file, line); | |
864 | } | |
865 | ||
866 | void CRYPTO_clear_free(void *ptr, size_t num, const char *file, int line) | |
867 | { | |
868 | c_CRYPTO_clear_free(ptr, num, file, line); | |
869 | } | |
870 | ||
871 | void *CRYPTO_realloc(void *addr, size_t num, const char *file, int line) | |
872 | { | |
873 | return c_CRYPTO_realloc(addr, num, file, line); | |
874 | } | |
875 | ||
876 | void *CRYPTO_clear_realloc(void *addr, size_t old_num, size_t num, | |
877 | const char *file, int line) | |
878 | { | |
879 | return c_CRYPTO_clear_realloc(addr, old_num, num, file, line); | |
880 | } | |
881 | ||
882 | void *CRYPTO_secure_malloc(size_t num, const char *file, int line) | |
883 | { | |
884 | return c_CRYPTO_secure_malloc(num, file, line); | |
885 | } | |
886 | ||
887 | void *CRYPTO_secure_zalloc(size_t num, const char *file, int line) | |
888 | { | |
889 | return c_CRYPTO_secure_zalloc(num, file, line); | |
890 | } | |
891 | ||
892 | void CRYPTO_secure_free(void *ptr, const char *file, int line) | |
893 | { | |
894 | c_CRYPTO_secure_free(ptr, file, line); | |
895 | } | |
896 | ||
897 | void CRYPTO_secure_clear_free(void *ptr, size_t num, const char *file, int line) | |
898 | { | |
899 | c_CRYPTO_secure_clear_free(ptr, num, file, line); | |
900 | } | |
901 | ||
b60cba3c RS |
902 | int CRYPTO_secure_allocated(const void *ptr) |
903 | { | |
904 | return c_CRYPTO_secure_allocated(ptr); | |
905 | } | |
d16d0b71 SL |
906 | |
907 | int BIO_snprintf(char *buf, size_t n, const char *format, ...) | |
908 | { | |
909 | va_list args; | |
910 | int ret; | |
911 | ||
912 | va_start(args, format); | |
913 | ret = c_BIO_vsnprintf(buf, n, format, args); | |
914 | va_end(args); | |
915 | return ret; | |
916 | } | |
991a6bb5 | 917 | |
6ce58488 | 918 | int FIPS_security_check_enabled(OSSL_LIB_CTX *libctx) |
991a6bb5 | 919 | { |
6ce58488 | 920 | FIPS_GLOBAL *fgbl = ossl_lib_ctx_get_data(libctx, |
927d0566 | 921 | OSSL_LIB_CTX_FIPS_PROV_INDEX); |
6ce58488 MC |
922 | |
923 | return fgbl->fips_security_checks; | |
991a6bb5 | 924 | } |
f8e74747 | 925 | |
b4250010 | 926 | void OSSL_SELF_TEST_get_callback(OSSL_LIB_CTX *libctx, OSSL_CALLBACK **cb, |
f8e74747 SL |
927 | void **cbarg) |
928 | { | |
6ce58488 | 929 | assert(libctx != NULL); |
f8e74747 SL |
930 | |
931 | if (c_stcbfn != NULL && c_get_libctx != NULL) { | |
932 | /* Get the parent libctx */ | |
933 | c_stcbfn(c_get_libctx(FIPS_get_core_handle(libctx)), cb, cbarg); | |
934 | } else { | |
935 | if (cb != NULL) | |
936 | *cb = NULL; | |
937 | if (cbarg != NULL) | |
938 | *cbarg = NULL; | |
939 | } | |
940 | } |