diff options
author | Shane Lontis <shane.lontis@oracle.com> | 2019-08-19 09:18:33 +1000 |
---|---|---|
committer | Shane Lontis <shane.lontis@oracle.com> | 2019-08-19 09:18:33 +1000 |
commit | 25e601445ae244ed623b2f5d6b28788488d87663 (patch) | |
tree | fe5c8cc5d0d9e828de208626a316e922dec258ff /providers | |
parent | 5e0d9c861bc44070c61b9b109884dc8aa5e2e8d1 (diff) |
Add fips provider code for handling self test data
More PR's related to self test will be derived from this PR.
Note: the code removed in core_get_params() was causing a freeze since the
fips module was being loaded from a config file, which then called core_get_params()
which then tried to init the config fle again...
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9596)
Diffstat (limited to 'providers')
-rw-r--r-- | providers/fips/fipsprov.c | 45 | ||||
-rw-r--r-- | providers/fips/selftest.h | 29 |
2 files changed, 74 insertions, 0 deletions
diff --git a/providers/fips/fipsprov.c b/providers/fips/fipsprov.c index d2d3e6044a..7afe4f911a 100644 --- a/providers/fips/fipsprov.c +++ b/providers/fips/fipsprov.c @@ -20,6 +20,7 @@ #include <openssl/sha.h> #include <openssl/rand_drbg.h> #include <openssl/ec.h> +#include <openssl/fips_names.h> #include "internal/cryptlib.h" #include "internal/property.h" @@ -27,6 +28,7 @@ #include "internal/provider_algs.h" #include "internal/provider_ctx.h" #include "internal/providercommon.h" +#include "selftest.h" extern OSSL_core_thread_start_fn *c_thread_start; @@ -36,6 +38,9 @@ extern OSSL_core_thread_start_fn *c_thread_start; * at the moment because c_put_error/c_add_error_vdata do not provide * us with the OPENSSL_CTX as a parameter. */ + +static SELF_TEST_POST_PARAMS selftest_params; + /* Functions provided by the core */ static OSSL_core_gettable_params_fn *c_gettable_params; static OSSL_core_get_params_fn *c_get_params; @@ -85,6 +90,31 @@ static const OSSL_PARAM fips_param_types[] = { OSSL_PARAM_END }; +/* + * Parameters to retrieve from the core provider - required for self testing. + * NOTE: inside core_get_params() these will be loaded from config items + * stored inside prov->parameters (except for OSSL_PROV_PARAM_MODULE_FILENAME). + */ +static OSSL_PARAM core_params[] = +{ + OSSL_PARAM_utf8_ptr(OSSL_PROV_PARAM_MODULE_FILENAME, + selftest_params.module_filename, + sizeof(selftest_params.module_filename)), + OSSL_PARAM_utf8_ptr(OSSL_PROV_FIPS_PARAM_MODULE_MAC, + selftest_params.module_checksum_data, + sizeof(selftest_params.module_checksum_data)), + OSSL_PARAM_utf8_ptr(OSSL_PROV_FIPS_PARAM_INSTALL_MAC, + selftest_params.indicator_checksum_data, + sizeof(selftest_params.indicator_checksum_data)), + OSSL_PARAM_utf8_ptr(OSSL_PROV_FIPS_PARAM_INSTALL_STATUS, + selftest_params.indicator_data, + sizeof(selftest_params.indicator_data)), + OSSL_PARAM_utf8_ptr(OSSL_PROV_FIPS_PARAM_INSTALL_VERSION, + selftest_params.indicator_version, + sizeof(selftest_params.indicator_version)), + OSSL_PARAM_END +}; + /* TODO(3.0): To be removed */ static int dummy_evp_call(void *provctx) { @@ -384,12 +414,27 @@ int OSSL_provider_init(const OSSL_PROVIDER *provider, case OSSL_FUNC_CRYPTO_SECURE_ALLOCATED: c_CRYPTO_secure_allocated = OSSL_get_CRYPTO_secure_allocated(in); break; + case OSSL_FUNC_BIO_NEW_FILE: + selftest_params.bio_new_file_cb = OSSL_get_BIO_new_file(in); + break; + case OSSL_FUNC_BIO_NEW_MEMBUF: + selftest_params.bio_new_buffer_cb = OSSL_get_BIO_new_membuf(in); + break; + case OSSL_FUNC_BIO_READ: + selftest_params.bio_read_cb = OSSL_get_BIO_read(in); + break; + case OSSL_FUNC_BIO_FREE: + selftest_params.bio_free_cb = OSSL_get_BIO_free(in); + break; default: /* Just ignore anything we don't understand */ break; } } + if (!c_get_params(provider, core_params)) + return 0; + /* Create a context. */ if ((ctx = OPENSSL_CTX_new()) == NULL) return 0; diff --git a/providers/fips/selftest.h b/providers/fips/selftest.h new file mode 100644 index 0000000000..3a183f4d02 --- /dev/null +++ b/providers/fips/selftest.h @@ -0,0 +1,29 @@ +/* + * Copyright 2019 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the OpenSSL license (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html + */ + +#include <openssl/params.h> +#include <openssl/core_numbers.h> + +typedef struct self_test_post_params_st { + /* FIPS module integrity check parameters */ + const char *module_filename; /* Module file to perform MAC on */ + const char *module_checksum_data; /* Expected module MAC integrity */ + + /* Used for KAT install indicator integrity check */ + const char *indicator_version; /* version - for future proofing */ + const char *indicator_data; /* data to perform MAC on */ + const char *indicator_checksum_data; /* Expected MAC integrity value */ + + /* BIO callbacks supplied to the FIPS provider */ + OSSL_BIO_new_file_fn *bio_new_file_cb; + OSSL_BIO_new_membuf_fn *bio_new_buffer_cb; + OSSL_BIO_read_fn *bio_read_cb; + OSSL_BIO_free_fn *bio_free_cb; + +} SELF_TEST_POST_PARAMS; |