[openssl] master update

shane.lontis at oracle.com shane.lontis at oracle.com
Tue May 25 05:01:41 UTC 2021


The branch master has been updated
       via  2abffec0f02ef400ca434890f5baf08fc24dd7ca (commit)
      from  a861711bcded8e259156342be697d72ec65f0aa2 (commit)


- Log -----------------------------------------------------------------
commit 2abffec0f02ef400ca434890f5baf08fc24dd7ca
Author: Shane Lontis <shane.lontis at oracle.com>
Date:   Wed May 5 10:36:41 2021 +1000

    Add fipsinstall option to run self test KATS on module load
    
    Reviewed-by: Paul Dale <pauli at openssl.org>
    Reviewed-by: Tim Hudson <tjh at openssl.org>
    (Merged from https://github.com/openssl/openssl/pull/15149)

-----------------------------------------------------------------------

Summary of changes:
 apps/fipsinstall.c                  | 64 ++++++++++++++++++++++---------------
 doc/man1/openssl-fipsinstall.pod.in | 13 +++++++-
 doc/man5/fips_config.pod            |  3 +-
 providers/fips/self_test.c          |  6 +++-
 test/recipes/03-test_fipsinstall.t  | 17 +++++++++-
 5 files changed, 73 insertions(+), 30 deletions(-)

diff --git a/apps/fipsinstall.c b/apps/fipsinstall.c
index 6a104e60aa..4defa0ab81 100644
--- a/apps/fipsinstall.c
+++ b/apps/fipsinstall.c
@@ -38,7 +38,8 @@ typedef enum OPTION_choice {
     OPT_PROV_NAME, OPT_SECTION_NAME, OPT_MAC_NAME, OPT_MACOPT, OPT_VERIFY,
     OPT_NO_LOG, OPT_CORRUPT_DESC, OPT_CORRUPT_TYPE, OPT_QUIET, OPT_CONFIG,
     OPT_NO_CONDITIONAL_ERRORS,
-    OPT_NO_SECURITY_CHECKS
+    OPT_NO_SECURITY_CHECKS,
+    OPT_SELF_TEST_ONLOAD
 } OPTION_CHOICE;
 
 const OPTIONS fipsinstall_options[] = {
@@ -55,6 +56,8 @@ const OPTIONS fipsinstall_options[] = {
       " any conditional self tests fail"},
     {"no_security_checks", OPT_NO_SECURITY_CHECKS, '-',
      "Disable the run-time FIPS security checks in the module"},
+    {"self_test_onload", OPT_SELF_TEST_ONLOAD, '-',
+     "Forces self tests to always run on module load"},
     OPT_SECTION("Input"),
     {"in", OPT_IN, '<', "Input config file, used when verifying"},
 
@@ -163,7 +166,7 @@ static int write_config_fips_section(BIO *out, const char *section,
                       module_mac_len))
         goto end;
 
-    if (install_mac != NULL) {
+    if (install_mac != NULL && install_mac_len > 0) {
         if (!print_mac(out, OSSL_PROV_FIPS_PARAM_INSTALL_MAC, install_mac,
                        install_mac_len)
             || BIO_printf(out, "%s = %s\n", OSSL_PROV_FIPS_PARAM_INSTALL_STATUS,
@@ -247,11 +250,6 @@ static int verify_config(const char *infile, const char *section,
         BIO_printf(bio_err, "version not found\n");
         goto end;
     }
-    s = NCONF_get_string(conf, section, OSSL_PROV_FIPS_PARAM_INSTALL_STATUS);
-    if (s == NULL || strcmp(s, INSTALL_STATUS_VAL) != 0) {
-        BIO_printf(bio_err, "install status not found\n");
-        goto end;
-    }
     s = NCONF_get_string(conf, section, OSSL_PROV_FIPS_PARAM_MODULE_MAC);
     if (s == NULL) {
         BIO_printf(bio_err, "Module integrity MAC not found\n");
@@ -264,17 +262,24 @@ static int verify_config(const char *infile, const char *section,
         BIO_printf(bio_err, "Module integrity mismatch\n");
         goto end;
     }
-    s = NCONF_get_string(conf, section, OSSL_PROV_FIPS_PARAM_INSTALL_MAC);
-    if (s == NULL) {
-        BIO_printf(bio_err, "Install indicator MAC not found\n");
-        goto end;
-    }
-    buf2 = OPENSSL_hexstr2buf(s, &len);
-    if (buf2 == NULL
-            || (size_t)len != install_mac_len
-            || memcmp(install_mac, buf2, install_mac_len) != 0) {
-        BIO_printf(bio_err, "Install indicator status mismatch\n");
-        goto end;
+    if (install_mac != NULL && install_mac_len > 0) {
+        s = NCONF_get_string(conf, section, OSSL_PROV_FIPS_PARAM_INSTALL_STATUS);
+        if (s == NULL || strcmp(s, INSTALL_STATUS_VAL) != 0) {
+            BIO_printf(bio_err, "install status not found\n");
+            goto end;
+        }
+        s = NCONF_get_string(conf, section, OSSL_PROV_FIPS_PARAM_INSTALL_MAC);
+        if (s == NULL) {
+            BIO_printf(bio_err, "Install indicator MAC not found\n");
+            goto end;
+        }
+        buf2 = OPENSSL_hexstr2buf(s, &len);
+        if (buf2 == NULL
+                || (size_t)len != install_mac_len
+                || memcmp(install_mac, buf2, install_mac_len) != 0) {
+            BIO_printf(bio_err, "Install indicator status mismatch\n");
+            goto end;
+        }
     }
     ret = 1;
 end:
@@ -286,7 +291,7 @@ end:
 
 int fipsinstall_main(int argc, char **argv)
 {
-    int ret = 1, verify = 0, gotkey = 0, gotdigest = 0;
+    int ret = 1, verify = 0, gotkey = 0, gotdigest = 0, self_test_onload = 0;
     int enable_conditional_errors = 1, enable_security_checks = 1;
     const char *section_name = "fips_sect";
     const char *mac_name = "HMAC";
@@ -371,6 +376,9 @@ opthelp:
         case OPT_VERIFY:
             verify = 1;
             break;
+        case OPT_SELF_TEST_ONLOAD:
+            self_test_onload = 1;
+            break;
         }
     }
 
@@ -462,14 +470,18 @@ opthelp:
     if (!do_mac(ctx, read_buffer, module_bio, module_mac, &module_mac_len))
         goto end;
 
-    mem_bio = BIO_new_mem_buf((const void *)INSTALL_STATUS_VAL,
-                              strlen(INSTALL_STATUS_VAL));
-    if (mem_bio == NULL) {
-        BIO_printf(bio_err, "Unable to create memory BIO\n");
-        goto end;
+    if (self_test_onload == 0) {
+        mem_bio = BIO_new_mem_buf((const void *)INSTALL_STATUS_VAL,
+                                  strlen(INSTALL_STATUS_VAL));
+        if (mem_bio == NULL) {
+            BIO_printf(bio_err, "Unable to create memory BIO\n");
+            goto end;
+        }
+        if (!do_mac(ctx2, read_buffer, mem_bio, install_mac, &install_mac_len))
+            goto end;
+    } else {
+        install_mac_len = 0;
     }
-    if (!do_mac(ctx2, read_buffer, mem_bio, install_mac, &install_mac_len))
-        goto end;
 
     if (verify) {
         if (!verify_config(in_fname, section_name, module_mac, module_mac_len,
diff --git a/doc/man1/openssl-fipsinstall.pod.in b/doc/man1/openssl-fipsinstall.pod.in
index 89e908c887..d79e237dba 100644
--- a/doc/man1/openssl-fipsinstall.pod.in
+++ b/doc/man1/openssl-fipsinstall.pod.in
@@ -21,6 +21,7 @@ B<openssl fipsinstall>
 [B<-quiet>]
 [B<-no_conditional_errors>]
 [B<-no_security_checks>]
+[B<-self_test_onload>]
 [B<-corrupt_desc> I<selftest_description>]
 [B<-corrupt_type> I<selftest_type>]
 [B<-config> I<parent_config>]
@@ -30,7 +31,7 @@ B<openssl fipsinstall>
 This command is used to generate a FIPS module configuration file.
 This configuration file can be used each time a FIPS module is loaded
 in order to pass data to the FIPS module self tests. The FIPS module always
-verifies its MAC, but only needs to run the KAT's once,
+verifies its MAC, but optionally only needs to run the KAT's once,
 at installation.
 
 The generated configuration file consists of:
@@ -163,6 +164,16 @@ fails as described above.
 
 Configure the module to not perform run-time security checks as described above.
 
+=item B<-self_test_onload>
+
+Do not write the two fields related to the "test status indicator" and
+"MAC status indicator" to the output configuration file. Without these fields
+the self tests KATS will run each time the module is loaded. This option could be
+used for cross compiling, since the self tests need to run at least once on each
+target machine. Once the self tests have run on the target machine the user
+could possibly then add the 2 fields into the configuration using some other
+mechanism.
+
 =item B<-quiet>
 
 Do not output pass/fail messages. Implies B<-noout>.
diff --git a/doc/man5/fips_config.pod b/doc/man5/fips_config.pod
index 728386544a..fe0e08ab9e 100644
--- a/doc/man5/fips_config.pod
+++ b/doc/man5/fips_config.pod
@@ -16,7 +16,8 @@ purposes:
 
 =item - Run the startup FIPS self-test known answer tests (KATS).
 
-This is done once, at installation time.
+This is normally done once, at installation time, but may also be set up to
+run each time the module is used.
 
 =item - Verify the module's checksum.
 
diff --git a/providers/fips/self_test.c b/providers/fips/self_test.c
index 34dbf6cb85..2b3b30de27 100644
--- a/providers/fips/self_test.c
+++ b/providers/fips/self_test.c
@@ -331,7 +331,11 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test)
         }
     }
 
-    /* Only runs the KAT's during installation OR on_demand() */
+    /*
+     * Only runs the KAT's during installation OR on_demand().
+     * NOTE: If the installation option 'self_test_onload' is chosen then this
+     * path will always be run, since kats_already_passed will always be 0.
+     */
     if (on_demand_test || kats_already_passed == 0) {
         if (!SELF_TEST_kats(ev, st->libctx)) {
             ERR_raise(ERR_LIB_PROV, PROV_R_SELF_TEST_KAT_FAILURE);
diff --git a/test/recipes/03-test_fipsinstall.t b/test/recipes/03-test_fipsinstall.t
index bc0c94cc97..c243b3b3af 100644
--- a/test/recipes/03-test_fipsinstall.t
+++ b/test/recipes/03-test_fipsinstall.t
@@ -24,7 +24,7 @@ use platform;
 
 plan skip_all => "Test only supported in a fips build" if disabled("fips");
 
-plan tests => 26;
+plan tests => 29;
 
 my $infile = bldtop_file('providers', platform->dso('fips'));
 my $fipskey = $ENV{FIPSKEY} // '00';
@@ -286,3 +286,18 @@ ok(replace_parent_line_file('fips_bad_module_mac.cnf',
    && !run(app(['openssl', 'fipsinstall',
                 '-config', 'fips_parent_bad_module_mac.cnf'])),
    "verify load config fail bad module mac");
+
+
+my $stconf = "fipsmodule_selftest.cnf";
+
+ok(run(app(['openssl', 'fipsinstall', '-out', $stconf,
+            '-module', $infile, '-self_test_onload'])),
+       "fipsinstall config saved without self test indicator");
+
+ok(!run(app(['openssl', 'fipsinstall', '-in', $stconf,
+             '-module', $infile, '-verify'])),
+        "fipsinstall config verify fails without self test indicator");
+
+ok(run(app(['openssl', 'fipsinstall', '-in', $stconf,
+            '-module', $infile, '-self_test_onload', '-verify'])),
+       "fipsinstall config verify passes when self test indicator is not present");


More information about the openssl-commits mailing list