[thirdparty/openssl.git] / apps / fipsinstall.c

/*
 * Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#include <string.h>
#include <openssl/evp.h>
#include <openssl/err.h>
#include <openssl/provider.h>
#include <openssl/params.h>
#include <openssl/fips_names.h>
#include "apps.h"
#include "progs.h"

#define BUFSIZE 4096
#define DEFAULT_MAC_NAME "HMAC"
#define DEFAULT_FIPS_SECTION "fips_check_section"

/* Configuration file values */
#define VERSION_KEY  "version"
#define VERSION_VAL  "1"
#define INSTALL_STATUS_VAL "INSTALL_SELF_TEST_KATS_RUN"

typedef enum OPTION_choice {
    OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
    OPT_IN, OPT_OUT, OPT_MODULE,
    OPT_PROV_NAME, OPT_SECTION_NAME, OPT_MAC_NAME, OPT_MACOPT, OPT_VERIFY
} OPTION_CHOICE;

const OPTIONS fipsinstall_options[] = {
    {"help", OPT_HELP, '-', "Display this summary"},
    {OPT_MORE_STR, 0, 0, "e.g: openssl fipsinstall -provider_name fips"
     "-section_name fipsinstall -out fips.conf -module ./fips.so"
     "-mac_name HMAC -macopt digest:SHA256 -macopt hexkey:00"},
    {"verify", OPT_VERIFY, '-', "Verification mode, i.e verify a config file "
     "instead of generating one"},
    {"in", OPT_IN, '<', "Input config file, used when verifying"},
    {"out", OPT_OUT, '>', "Output config file, used when generating"},
    {"module", OPT_MODULE, '<', "File name of the provider module"},
    {"provider_name", OPT_PROV_NAME, 's', "FIPS provider name"},
    {"section_name", OPT_SECTION_NAME, 's',
     "FIPS Provider config section name (optional)"},
    {"mac_name", OPT_MAC_NAME, 's', "MAC name"},
    {"macopt", OPT_MACOPT, 's', "MAC algorithm parameters in n:v form. "
                                "See 'PARAMETER NAMES' in the EVP_MAC_ docs"},
    {NULL}
};

static int do_mac(EVP_MAC_CTX *ctx, unsigned char *tmp, BIO *in,
                  unsigned char *out, size_t *out_len)
{
    int ret = 0;
    int i;
    size_t outsz = *out_len;

    if (!EVP_MAC_init(ctx))
        goto err;
    if (EVP_MAC_size(ctx) > outsz)
        goto end;
    while ((i = BIO_read(in, (char *)tmp, BUFSIZE)) != 0) {
        if (i < 0 || !EVP_MAC_update(ctx, tmp, i))
            goto err;
    }
end:
    if (!EVP_MAC_final(ctx, out, out_len, outsz))
        goto err;
    ret = 1;
err:
    return ret;
}

static int load_fips_prov_and_run_self_test(const char *prov_name)
{
    int ret = 0;
    OSSL_PROVIDER *prov = NULL;

    prov = OSSL_PROVIDER_load(NULL, prov_name);
    if (prov == NULL) {
        BIO_printf(bio_err, "Failed to load FIPS module\n");
        goto end;
    }
    ret = 1;
end:
    OSSL_PROVIDER_unload(prov);
    return ret;
}

static int print_mac(BIO *bio, const char *label, const unsigned char *mac,
                     size_t len)
{
    int ret;
    char *hexstr = NULL;

    hexstr = OPENSSL_buf2hexstr(mac, (long)len);
    if (hexstr == NULL)
        return 0;
    ret = BIO_printf(bio, "%s = %s\n", label, hexstr);
    OPENSSL_free(hexstr);
    return ret;
}

static int write_config_header(BIO *out, const char *prov_name,
                               const char *section)
{
    return BIO_printf(out, "openssl_conf = openssl_init\n\n")
           && BIO_printf(out, "[openssl_init]\n")
           && BIO_printf(out, "providers = provider_section\n\n")
           && BIO_printf(out, "[provider_section]\n")
           && BIO_printf(out, "%s = %s\n\n", prov_name, section);
}

/*
 * Outputs a fips related config file that contains entries for the fips
 * module checksum and the installation indicator checksum.
 *
 * Returns 1 if the config file is written otherwise it returns 0 on error.
 */
static int write_config_fips_section(BIO *out, const char *section,
                                     unsigned char *module_mac,
                                     size_t module_mac_len,
                                     unsigned char *install_mac,
                                     size_t install_mac_len)
{
    int ret = 0;

    if (!(BIO_printf(out, "[%s]\n", section) > 0
          && BIO_printf(out, "activate = 1\n") > 0
          && BIO_printf(out, "%s = %s\n", OSSL_PROV_FIPS_PARAM_INSTALL_VERSION,
                        VERSION_VAL) > 0
          && print_mac(out, OSSL_PROV_FIPS_PARAM_MODULE_MAC, module_mac,
                       module_mac_len)))
        goto end;

    if (install_mac != NULL) {
        if (!(print_mac(out, OSSL_PROV_FIPS_PARAM_INSTALL_MAC, install_mac,
                      install_mac_len)
              && BIO_printf(out, "%s = %s\n",
                            OSSL_PROV_FIPS_PARAM_INSTALL_STATUS,
                            INSTALL_STATUS_VAL) > 0))
        goto end;
    }
    ret = 1;
end:
    return ret;
}

static CONF *generate_config_and_load(const char *prov_name,
                                      const char *section,
                                      unsigned char *module_mac,
                                      size_t module_mac_len)
{
    BIO *mem_bio = NULL;
    CONF *conf = NULL;

    mem_bio = BIO_new(BIO_s_mem());
    if (mem_bio  == NULL)
        return 0;
    if (!write_config_header(mem_bio, prov_name, section)
         || !write_config_fips_section(mem_bio, section, module_mac,
                                       module_mac_len, NULL, 0))
        goto end;

    conf = app_load_config_bio(mem_bio, NULL);
    if (conf == NULL)
        goto end;

    if (!CONF_modules_load(conf, NULL, 0))
        goto end;
    BIO_free(mem_bio);
    return conf;
end:
    NCONF_free(conf);
    BIO_free(mem_bio);
    return NULL;
}

static void free_config_and_unload(CONF *conf)
{
    if (conf != NULL) {
        NCONF_free(conf);
        CONF_modules_unload(1);
    }
}

/*
 * Returns 1 if the config file entries match the passed in module_mac and
 * install_mac values, otherwise it returns 0.
 */
static int verify_config(const char *infile, const char *section,
                         unsigned char *module_mac, size_t module_mac_len,
                         unsigned char *install_mac, size_t install_mac_len)
{
    int ret = 0;
    char *s = NULL;
    unsigned char *buf1 = NULL, *buf2 = NULL;
    long len;
    CONF *conf = NULL;

    /* read in the existing values and check they match the saved values */
    conf = app_load_config(infile);
    if (conf == NULL)
        goto end;

    s = NCONF_get_string(conf, section, OSSL_PROV_FIPS_PARAM_INSTALL_VERSION);
    if (s == NULL || strcmp(s, VERSION_VAL) != 0) {
        BIO_printf(bio_err, "version not found\n");
        goto end;
    }
    s = NCONF_get_string(conf, section, OSSL_PROV_FIPS_PARAM_INSTALL_STATUS);
    if (s == NULL || strcmp(s, INSTALL_STATUS_VAL) != 0) {
        BIO_printf(bio_err, "install status not found\n");
        goto end;
    }
    s = NCONF_get_string(conf, section, OSSL_PROV_FIPS_PARAM_MODULE_MAC);
    if (s == NULL) {
        BIO_printf(bio_err, "Module integrity MAC not found\n");
        goto end;
    }
    buf1 = OPENSSL_hexstr2buf(s, &len);
    if (buf1 == NULL
            || (size_t)len != module_mac_len
            || memcmp(module_mac, buf1, module_mac_len) != 0) {
        BIO_printf(bio_err, "Module integrity mismatch\n");
        goto end;
    }
    s = NCONF_get_string(conf, section, OSSL_PROV_FIPS_PARAM_INSTALL_MAC);
    if (s == NULL) {
        BIO_printf(bio_err, "Install indicator MAC not found\n");
        goto end;
    }
    buf2 = OPENSSL_hexstr2buf(s, &len);
    if (buf2 == NULL
            || (size_t)len != install_mac_len
            || memcmp(install_mac, buf2, install_mac_len) != 0) {
        BIO_printf(bio_err, "Install indicator status mismatch\n");
        goto end;
    }
    ret = 1;
end:
    OPENSSL_free(buf1);
    OPENSSL_free(buf2);
    NCONF_free(conf);
    return ret;
}

int fipsinstall_main(int argc, char **argv)
{
    int ret = 1, verify = 0;
    BIO *module_bio = NULL, *mem_bio = NULL, *fout = NULL;
    char *in_fname = NULL, *out_fname = NULL, *prog, *section_name = NULL;
    char *prov_name = NULL, *module_fname = NULL;
    static const char *mac_name = DEFAULT_MAC_NAME;
    EVP_MAC_CTX *ctx = NULL, *ctx2 = NULL;
    STACK_OF(OPENSSL_STRING) *opts = NULL;
    OPTION_CHOICE o;
    unsigned char *read_buffer = NULL;
    unsigned char module_mac[EVP_MAX_MD_SIZE];
    size_t module_mac_len = EVP_MAX_MD_SIZE;
    unsigned char install_mac[EVP_MAX_MD_SIZE];
    size_t install_mac_len = EVP_MAX_MD_SIZE;
    EVP_MAC *mac = NULL;
    CONF *conf = NULL;

    section_name = DEFAULT_FIPS_SECTION;

    prog = opt_init(argc, argv, fipsinstall_options);
    while ((o = opt_next()) != OPT_EOF) {
        switch (o) {
        case OPT_EOF:
        case OPT_ERR:
opthelp:
            BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
            goto end;
        case OPT_HELP:
            opt_help(fipsinstall_options);
            ret = 0;
            goto end;
        case OPT_IN:
            in_fname = opt_arg();
            break;
        case OPT_OUT:
            out_fname = opt_arg();
            break;
        case OPT_PROV_NAME:
            prov_name = opt_arg();
            break;
        case OPT_MODULE:
            module_fname = opt_arg();
            break;
        case OPT_SECTION_NAME:
            section_name = opt_arg();
            break;
        case OPT_MAC_NAME:
            mac_name = opt_arg();
            break;
        case OPT_MACOPT:
            if (opts == NULL)
                opts = sk_OPENSSL_STRING_new_null();
            if (opts == NULL || !sk_OPENSSL_STRING_push(opts, opt_arg()))
                goto opthelp;
            break;
        case OPT_VERIFY:
            verify = 1;
            break;
        }
    }
    argc = opt_num_rest();
    if (module_fname == NULL
        || (verify && in_fname == NULL)
        || (!verify && (out_fname == NULL || prov_name == NULL))
        || opts == NULL
        || argc != 0)
        goto opthelp;

    module_bio = bio_open_default(module_fname, 'r', FORMAT_BINARY);
    if (module_bio == NULL) {
        BIO_printf(bio_err, "Failed to open module file\n");
        goto end;
    }

    read_buffer = app_malloc(BUFSIZE, "I/O buffer");
    if (read_buffer == NULL)
        goto end;

    mac = EVP_MAC_fetch(NULL, mac_name, NULL);
    if (mac == NULL) {
        BIO_printf(bio_err, "Unable to get MAC of type %s\n", mac_name);
        goto end;
    }

    ctx = EVP_MAC_CTX_new(mac);
    if (ctx == NULL) {
        BIO_printf(bio_err, "Unable to create MAC CTX for module check\n");
        goto end;
    }

    if (opts != NULL) {
        int ok = 1;
        OSSL_PARAM *params =
            app_params_new_from_opts(opts, EVP_MAC_CTX_settable_params(mac));

        if (params == NULL)
            goto end;

        if (!EVP_MAC_CTX_set_params(ctx, params)) {
            BIO_printf(bio_err, "MAC parameter error\n");
            ERR_print_errors(bio_err);
            ok = 0;
        }
        app_params_free(params);
        if (!ok)
            goto end;
    }

    ctx2 = EVP_MAC_CTX_dup(ctx);
    if (ctx2 == NULL) {
        BIO_printf(bio_err, "Unable to create MAC CTX for install indicator\n");
        goto end;
    }

    if (!do_mac(ctx, read_buffer, module_bio, module_mac, &module_mac_len))
        goto end;

    mem_bio = BIO_new_mem_buf((const void *)INSTALL_STATUS_VAL,
                              strlen(INSTALL_STATUS_VAL));
    if (mem_bio == NULL) {
        BIO_printf(bio_err, "Unable to create memory BIO\n");
        goto end;
    }
    if (!do_mac(ctx2, read_buffer, mem_bio, install_mac, &install_mac_len))
        goto end;

    if (verify) {
        if (!verify_config(in_fname, section_name, module_mac, module_mac_len,
                           install_mac, install_mac_len))
            goto end;
        BIO_printf(bio_out, "VERIFY PASSED\n");
    } else {

        conf = generate_config_and_load(prov_name, section_name, module_mac,
                                        module_mac_len);
        if (conf == NULL)
            goto end;
        if (!load_fips_prov_and_run_self_test(prov_name))
            goto end;

        fout = bio_open_default(out_fname, 'w', FORMAT_TEXT);
        if (fout == NULL) {
            BIO_printf(bio_err, "Failed to open file\n");
            goto end;
        }
        if (!write_config_fips_section(fout, section_name, module_mac,
                                       module_mac_len, install_mac,
                                       install_mac_len))
            goto end;
        BIO_printf(bio_out, "INSTALL PASSED\n");
    }

    ret = 0;
end:
    if (ret == 1) {
        BIO_printf(bio_err, "%s FAILED\n", verify ? "VERIFY" : "INSTALL");
        ERR_print_errors(bio_err);
    }

    BIO_free(fout);
    BIO_free(mem_bio);
    BIO_free(module_bio);
    sk_OPENSSL_STRING_free(opts);
    EVP_MAC_free(mac);
    EVP_MAC_CTX_free(ctx2);
    EVP_MAC_CTX_free(ctx);
    OPENSSL_free(read_buffer);
    free_config_and_unload(conf);
    return ret;
}
Commit	Line	Data
95214b43 SL	1	/*
	2	* Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
	3	*
	4	* Licensed under the Apache License 2.0 (the "License"). You may not use
	5	* this file except in compliance with the License. You can obtain a copy
	6	* in the file LICENSE in the source distribution or at
	7	* https://www.openssl.org/source/license.html
	8	*/
	9
	10	#include <string.h>
	11	#include <openssl/evp.h>
	12	#include <openssl/err.h>
	13	#include <openssl/provider.h>
	14	#include <openssl/params.h>
	15	#include <openssl/fips_names.h>
	16	#include "apps.h"
	17	#include "progs.h"
	18
	19	#define BUFSIZE 4096
	20	#define DEFAULT_MAC_NAME "HMAC"
	21	#define DEFAULT_FIPS_SECTION "fips_check_section"
	22
	23	/* Configuration file values */
	24	#define VERSION_KEY "version"
	25	#define VERSION_VAL "1"
	26	#define INSTALL_STATUS_VAL "INSTALL_SELF_TEST_KATS_RUN"
	27
	28	typedef enum OPTION_choice {
	29	OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
	30	OPT_IN, OPT_OUT, OPT_MODULE,
	31	OPT_PROV_NAME, OPT_SECTION_NAME, OPT_MAC_NAME, OPT_MACOPT, OPT_VERIFY
	32	} OPTION_CHOICE;
	33
	34	const OPTIONS fipsinstall_options[] = {
	35	{"help", OPT_HELP, '-', "Display this summary"},
	36	{OPT_MORE_STR, 0, 0, "e.g: openssl fipsinstall -provider_name fips"
	37	"-section_name fipsinstall -out fips.conf -module ./fips.so"
	38	"-mac_name HMAC -macopt digest:SHA256 -macopt hexkey:00"},
	39	{"verify", OPT_VERIFY, '-', "Verification mode, i.e verify a config file "
	40	"instead of generating one"},
	41	{"in", OPT_IN, '<', "Input config file, used when verifying"},
	42	{"out", OPT_OUT, '>', "Output config file, used when generating"},
	43	{"module", OPT_MODULE, '<', "File name of the provider module"},
	44	{"provider_name", OPT_PROV_NAME, 's', "FIPS provider name"},
	45	{"section_name", OPT_SECTION_NAME, 's',
	46	"FIPS Provider config section name (optional)"},
	47	{"mac_name", OPT_MAC_NAME, 's', "MAC name"},
	48	{"macopt", OPT_MACOPT, 's', "MAC algorithm parameters in n:v form. "
	49	"See 'PARAMETER NAMES' in the EVP_MAC_ docs"},
	50	{NULL}
	51	};
	52
	53	static int do_mac(EVP_MAC_CTX ctx, unsigned char tmp, BIO *in,
	54	unsigned char out, size_t out_len)
	55	{
	56	int ret = 0;
	57	int i;
	58	size_t outsz = *out_len;
	59
	60	if (!EVP_MAC_init(ctx))
	61	goto err;
	62	if (EVP_MAC_size(ctx) > outsz)
	63	goto end;
	64	while ((i = BIO_read(in, (char *)tmp, BUFSIZE)) != 0) {
65	if (i < 0 \|\| !EVP_MAC_update(ctx, tmp, i))
66	goto err;
67	}
68	end:
69	if (!EVP_MAC_final(ctx, out, out_len, outsz))
70	goto err;
71	ret = 1;
72	err:
73	return ret;
74	}
75
76	static int load_fips_prov_and_run_self_test(const char *prov_name)
77	{
78	int ret = 0;
79	OSSL_PROVIDER *prov = NULL;
80
81	prov = OSSL_PROVIDER_load(NULL, prov_name);
82	if (prov == NULL) {
83	BIO_printf(bio_err, "Failed to load FIPS module\n");
84	goto end;
85	}
86	ret = 1;
87	end:
88	OSSL_PROVIDER_unload(prov);
89	return ret;
90	}
91
92	static int print_mac(BIO bio, const char label, const unsigned char *mac,
93	size_t len)
94	{
95	int ret;
96	char *hexstr = NULL;
97
98	hexstr = OPENSSL_buf2hexstr(mac, (long)len);
99	if (hexstr == NULL)
100	return 0;
101	ret = BIO_printf(bio, "%s = %s\n", label, hexstr);
102	OPENSSL_free(hexstr);
103	return ret;
104	}
105
106	static int write_config_header(BIO out, const char prov_name,
107	const char *section)
108	{
109	return BIO_printf(out, "openssl_conf = openssl_init\n\n")
110	&& BIO_printf(out, "[openssl_init]\n")
111	&& BIO_printf(out, "providers = provider_section\n\n")
112	&& BIO_printf(out, "[provider_section]\n")
113	&& BIO_printf(out, "%s = %s\n\n", prov_name, section);
114	}
115
116	/*
117	* Outputs a fips related config file that contains entries for the fips
118	* module checksum and the installation indicator checksum.
119	*
120	* Returns 1 if the config file is written otherwise it returns 0 on error.
121	*/
122	static int write_config_fips_section(BIO out, const char section,
123	unsigned char *module_mac,
124	size_t module_mac_len,
125	unsigned char *install_mac,
126	size_t install_mac_len)
127	{
128	int ret = 0;
129
130	if (!(BIO_printf(out, "[%s]\n", section) > 0
7bb82f92	131	&& BIO_printf(out, "activate = 1\n") > 0
95214b43 SL	132	&& BIO_printf(out, "%s = %s\n", OSSL_PROV_FIPS_PARAM_INSTALL_VERSION,
	133	VERSION_VAL) > 0
	134	&& print_mac(out, OSSL_PROV_FIPS_PARAM_MODULE_MAC, module_mac,
	135	module_mac_len)))
	136	goto end;
	137
	138	if (install_mac != NULL) {
	139	if (!(print_mac(out, OSSL_PROV_FIPS_PARAM_INSTALL_MAC, install_mac,
	140	install_mac_len)
	141	&& BIO_printf(out, "%s = %s\n",
	142	OSSL_PROV_FIPS_PARAM_INSTALL_STATUS,
	143	INSTALL_STATUS_VAL) > 0))
	144	goto end;
	145	}
	146	ret = 1;
	147	end:
	148	return ret;
	149	}
	150
	151	static CONF generate_config_and_load(const char prov_name,
	152	const char *section,
	153	unsigned char *module_mac,
	154	size_t module_mac_len)
	155	{
	156	BIO *mem_bio = NULL;
	157	CONF *conf = NULL;
	158
	159	mem_bio = BIO_new(BIO_s_mem());
	160	if (mem_bio == NULL)
	161	return 0;
	162	if (!write_config_header(mem_bio, prov_name, section)
	163	\|\| !write_config_fips_section(mem_bio, section, module_mac,
	164	module_mac_len, NULL, 0))
	165	goto end;
	166
	167	conf = app_load_config_bio(mem_bio, NULL);
	168	if (conf == NULL)
	169	goto end;
	170
	171	if (!CONF_modules_load(conf, NULL, 0))
	172	goto end;
	173	BIO_free(mem_bio);
	174	return conf;
	175	end:
	176	NCONF_free(conf);
	177	BIO_free(mem_bio);
	178	return NULL;
	179	}
	180
	181	static void free_config_and_unload(CONF *conf)
	182	{
	183	if (conf != NULL) {
	184	NCONF_free(conf);
	185	CONF_modules_unload(1);
	186	}
	187	}
	188
	189	/*
	190	* Returns 1 if the config file entries match the passed in module_mac and
	191	* install_mac values, otherwise it returns 0.
	192	*/
	193	static int verify_config(const char infile, const char section,
	194	unsigned char *module_mac, size_t module_mac_len,
	195	unsigned char *install_mac, size_t install_mac_len)
196	{
197	int ret = 0;
198	char *s = NULL;
199	unsigned char buf1 = NULL, buf2 = NULL;
200	long len;
201	CONF *conf = NULL;
202
203	/* read in the existing values and check they match the saved values */
204	conf = app_load_config(infile);
205	if (conf == NULL)
206	goto end;
207
208	s = NCONF_get_string(conf, section, OSSL_PROV_FIPS_PARAM_INSTALL_VERSION);
209	if (s == NULL \|\| strcmp(s, VERSION_VAL) != 0) {
210	BIO_printf(bio_err, "version not found\n");
211	goto end;
212	}
213	s = NCONF_get_string(conf, section, OSSL_PROV_FIPS_PARAM_INSTALL_STATUS);
214	if (s == NULL \|\| strcmp(s, INSTALL_STATUS_VAL) != 0) {
215	BIO_printf(bio_err, "install status not found\n");
216	goto end;
217	}
218	s = NCONF_get_string(conf, section, OSSL_PROV_FIPS_PARAM_MODULE_MAC);
219	if (s == NULL) {
220	BIO_printf(bio_err, "Module integrity MAC not found\n");
221	goto end;
222	}
223	buf1 = OPENSSL_hexstr2buf(s, &len);
224	if (buf1 == NULL
225	\|\| (size_t)len != module_mac_len
226	\|\| memcmp(module_mac, buf1, module_mac_len) != 0) {
227	BIO_printf(bio_err, "Module integrity mismatch\n");
228	goto end;
229	}
230	s = NCONF_get_string(conf, section, OSSL_PROV_FIPS_PARAM_INSTALL_MAC);
231	if (s == NULL) {
232	BIO_printf(bio_err, "Install indicator MAC not found\n");
233	goto end;
234	}
235	buf2 = OPENSSL_hexstr2buf(s, &len);
236	if (buf2 == NULL
237	\|\| (size_t)len != install_mac_len
238	\|\| memcmp(install_mac, buf2, install_mac_len) != 0) {
239	BIO_printf(bio_err, "Install indicator status mismatch\n");
240	goto end;
241	}
242	ret = 1;
243	end:
244	OPENSSL_free(buf1);
245	OPENSSL_free(buf2);
246	NCONF_free(conf);
247	return ret;
248	}
249
250	int fipsinstall_main(int argc, char **argv)
251	{
252	int ret = 1, verify = 0;
253	BIO module_bio = NULL, mem_bio = NULL, *fout = NULL;
254	char in_fname = NULL, out_fname = NULL, prog, section_name = NULL;
255	char prov_name = NULL, module_fname = NULL;
256	static const char *mac_name = DEFAULT_MAC_NAME;
257	EVP_MAC_CTX ctx = NULL, ctx2 = NULL;
258	STACK_OF(OPENSSL_STRING) *opts = NULL;
259	OPTION_CHOICE o;
260	unsigned char *read_buffer = NULL;
261	unsigned char module_mac[EVP_MAX_MD_SIZE];
262	size_t module_mac_len = EVP_MAX_MD_SIZE;
263	unsigned char install_mac[EVP_MAX_MD_SIZE];
264	size_t install_mac_len = EVP_MAX_MD_SIZE;
265	EVP_MAC *mac = NULL;
266	CONF *conf = NULL;
267
268	section_name = DEFAULT_FIPS_SECTION;
269
270	prog = opt_init(argc, argv, fipsinstall_options);
271	while ((o = opt_next()) != OPT_EOF) {
272	switch (o) {
273	case OPT_EOF:
274	case OPT_ERR:
275	opthelp:
276	BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
277	goto end;
278	case OPT_HELP:
279	opt_help(fipsinstall_options);
280	ret = 0;
281	goto end;
282	case OPT_IN:
283	in_fname = opt_arg();
284	break;
285	case OPT_OUT:
286	out_fname = opt_arg();
287	break;
288	case OPT_PROV_NAME:
289	prov_name = opt_arg();
290	break;
291	case OPT_MODULE:
292	module_fname = opt_arg();
293	break;
294	case OPT_SECTION_NAME:
295	section_name = opt_arg();
296	break;
297	case OPT_MAC_NAME:
298	mac_name = opt_arg();
299	break;
300	case OPT_MACOPT:
301	if (opts == NULL)
302	opts = sk_OPENSSL_STRING_new_null();
303	if (opts == NULL \|\| !sk_OPENSSL_STRING_push(opts, opt_arg()))
304	goto opthelp;
305	break;
306	case OPT_VERIFY:
307	verify = 1;
308	break;
309	}
310	}
311	argc = opt_num_rest();
312	if (module_fname == NULL
313	\|\| (verify && in_fname == NULL)
314	\|\| (!verify && (out_fname == NULL \|\| prov_name == NULL))
315	\|\| opts == NULL
316	\|\| argc != 0)
317	goto opthelp;
318
319	module_bio = bio_open_default(module_fname, 'r', FORMAT_BINARY);
320	if (module_bio == NULL) {
321	BIO_printf(bio_err, "Failed to open module file\n");
322	goto end;
323	}
324
325	read_buffer = app_malloc(BUFSIZE, "I/O buffer");
326	if (read_buffer == NULL)
327	goto end;
328
329	mac = EVP_MAC_fetch(NULL, mac_name, NULL);
330	if (mac == NULL) {
331	BIO_printf(bio_err, "Unable to get MAC of type %s\n", mac_name);
332	goto end;
333	}
334
335	ctx = EVP_MAC_CTX_new(mac);
336	if (ctx == NULL) {
337	BIO_printf(bio_err, "Unable to create MAC CTX for module check\n");
338	goto end;
339	}
340
341	if (opts != NULL) {
342	int ok = 1;
343	OSSL_PARAM *params =
344	app_params_new_from_opts(opts, EVP_MAC_CTX_settable_params(mac));
345
346	if (params == NULL)
347	goto end;
348
349	if (!EVP_MAC_CTX_set_params(ctx, params)) {
350	BIO_printf(bio_err, "MAC parameter error\n");
351	ERR_print_errors(bio_err);
352	ok = 0;
353	}
354	app_params_free(params);
355	if (!ok)
356	goto end;
357	}
358
359	ctx2 = EVP_MAC_CTX_dup(ctx);
360	if (ctx2 == NULL) {
361	BIO_printf(bio_err, "Unable to create MAC CTX for install indicator\n");
362	goto end;
363	}
364
365	if (!do_mac(ctx, read_buffer, module_bio, module_mac, &module_mac_len))
366	goto end;
367
368	mem_bio = BIO_new_mem_buf((const void *)INSTALL_STATUS_VAL,
369	strlen(INSTALL_STATUS_VAL));
370	if (mem_bio == NULL) {
371	BIO_printf(bio_err, "Unable to create memory BIO\n");
372	goto end;
373	}
374	if (!do_mac(ctx2, read_buffer, mem_bio, install_mac, &install_mac_len))
375	goto end;
376
377	if (verify) {
378	if (!verify_config(in_fname, section_name, module_mac, module_mac_len,
379	install_mac, install_mac_len))
380	goto end;
381	BIO_printf(bio_out, "VERIFY PASSED\n");
382	} else {
383
384	conf = generate_config_and_load(prov_name, section_name, module_mac,
385	module_mac_len);
386	if (conf == NULL)
387	goto end;
388	if (!load_fips_prov_and_run_self_test(prov_name))
389	goto end;
390
391	fout = bio_open_default(out_fname, 'w', FORMAT_TEXT);
392	if (fout == NULL) {
393	BIO_printf(bio_err, "Failed to open file\n");
394	goto end;
395	}
396	if (!write_config_fips_section(fout, section_name, module_mac,
397	module_mac_len, install_mac,
398	install_mac_len))
399	goto end;
400	BIO_printf(bio_out, "INSTALL PASSED\n");
401	}
402
403	ret = 0;
404	end:
405	if (ret == 1) {
406	BIO_printf(bio_err, "%s FAILED\n", verify ? "VERIFY" : "INSTALL");
407	ERR_print_errors(bio_err);
408	}
409
410	BIO_free(fout);
411	BIO_free(mem_bio);
412	BIO_free(module_bio);
413	sk_OPENSSL_STRING_free(opts);
414	EVP_MAC_free(mac);
415	EVP_MAC_CTX_free(ctx2);
416	EVP_MAC_CTX_free(ctx);
417	OPENSSL_free(read_buffer);
418	free_config_and_unload(conf);
419	return ret;
420	}