aboutsummaryrefslogtreecommitdiff
path: root/crypto/openssl/apps/fipsinstall.c
diff options
context:
space:
mode:
Diffstat (limited to 'crypto/openssl/apps/fipsinstall.c')
-rw-r--r--crypto/openssl/apps/fipsinstall.c524
1 files changed, 284 insertions, 240 deletions
diff --git a/crypto/openssl/apps/fipsinstall.c b/crypto/openssl/apps/fipsinstall.c
index 0daa55a1b8ae..dcc09a5ed7f7 100644
--- a/crypto/openssl/apps/fipsinstall.c
+++ b/crypto/openssl/apps/fipsinstall.c
@@ -21,8 +21,8 @@
#define BUFSIZE 4096
/* Configuration file values */
-#define VERSION_KEY "version"
-#define VERSION_VAL "1"
+#define VERSION_KEY "version"
+#define VERSION_VAL "1"
#define INSTALL_STATUS_VAL "INSTALL_SELF_TEST_KATS_RUN"
static OSSL_CALLBACK self_test_events;
@@ -33,15 +33,29 @@ static int quiet = 0;
typedef enum OPTION_choice {
OPT_COMMON,
- OPT_IN, OPT_OUT, OPT_MODULE, OPT_PEDANTIC,
- OPT_PROV_NAME, OPT_SECTION_NAME, OPT_MAC_NAME, OPT_MACOPT, OPT_VERIFY,
- OPT_NO_LOG, OPT_CORRUPT_DESC, OPT_CORRUPT_TYPE, OPT_QUIET, OPT_CONFIG,
+ OPT_IN,
+ OPT_OUT,
+ OPT_MODULE,
+ OPT_PEDANTIC,
+ OPT_PROV_NAME,
+ OPT_SECTION_NAME,
+ OPT_MAC_NAME,
+ OPT_MACOPT,
+ OPT_VERIFY,
+ OPT_NO_LOG,
+ OPT_CORRUPT_DESC,
+ OPT_CORRUPT_TYPE,
+ OPT_QUIET,
+ OPT_CONFIG,
OPT_NO_CONDITIONAL_ERRORS,
OPT_NO_SECURITY_CHECKS,
- OPT_TLS_PRF_EMS_CHECK, OPT_NO_SHORT_MAC,
- OPT_DISALLOW_PKCS15_PADDING, OPT_RSA_PSS_SALTLEN_CHECK,
+ OPT_TLS_PRF_EMS_CHECK,
+ OPT_NO_SHORT_MAC,
+ OPT_DISALLOW_PKCS15_PADDING,
+ OPT_RSA_PSS_SALTLEN_CHECK,
OPT_DISALLOW_SIGNATURE_X931_PADDING,
- OPT_HMAC_KEY_CHECK, OPT_KMAC_KEY_CHECK,
+ OPT_HMAC_KEY_CHECK,
+ OPT_KMAC_KEY_CHECK,
OPT_DISALLOW_DRGB_TRUNC_DIGEST,
OPT_SIGNATURE_DIGEST_CHECK,
OPT_HKDF_DIGEST_CHECK,
@@ -62,93 +76,94 @@ typedef enum OPTION_choice {
OPT_X942KDF_KEY_CHECK,
OPT_NO_PBKDF2_LOWER_BOUND_CHECK,
OPT_ECDH_COFACTOR_CHECK,
- OPT_SELF_TEST_ONLOAD, OPT_SELF_TEST_ONINSTALL
+ OPT_SELF_TEST_ONLOAD,
+ OPT_SELF_TEST_ONINSTALL
} OPTION_CHOICE;
const OPTIONS fipsinstall_options[] = {
OPT_SECTION("General"),
- {"help", OPT_HELP, '-', "Display this summary"},
- {"pedantic", OPT_PEDANTIC, '-', "Set options for strict FIPS compliance"},
- {"verify", OPT_VERIFY, '-',
- "Verify a config file instead of generating one"},
- {"module", OPT_MODULE, '<', "File name of the provider module"},
- {"provider_name", OPT_PROV_NAME, 's', "FIPS provider name"},
- {"section_name", OPT_SECTION_NAME, 's',
- "FIPS Provider config section name (optional)"},
- {"no_conditional_errors", OPT_NO_CONDITIONAL_ERRORS, '-',
- "Disable the ability of the fips module to enter an error state if"
- " any conditional self tests fail"},
- {"no_security_checks", OPT_NO_SECURITY_CHECKS, '-',
- "Disable the run-time FIPS security checks in the module"},
- {"self_test_onload", OPT_SELF_TEST_ONLOAD, '-',
- "Forces self tests to always run on module load"},
- {"self_test_oninstall", OPT_SELF_TEST_ONINSTALL, '-',
- "Forces self tests to run once on module installation"},
- {"ems_check", OPT_TLS_PRF_EMS_CHECK, '-',
- "Enable the run-time FIPS check for EMS during TLS1_PRF"},
- {"no_short_mac", OPT_NO_SHORT_MAC, '-', "Disallow short MAC output"},
- {"no_drbg_truncated_digests", OPT_DISALLOW_DRGB_TRUNC_DIGEST, '-',
- "Disallow truncated digests with Hash and HMAC DRBGs"},
- {"signature_digest_check", OPT_SIGNATURE_DIGEST_CHECK, '-',
- "Enable checking for approved digests for signatures"},
- {"hmac_key_check", OPT_HMAC_KEY_CHECK, '-', "Enable key check for HMAC"},
- {"kmac_key_check", OPT_KMAC_KEY_CHECK, '-', "Enable key check for KMAC"},
- {"hkdf_digest_check", OPT_HKDF_DIGEST_CHECK, '-',
- "Enable digest check for HKDF"},
- {"tls13_kdf_digest_check", OPT_TLS13_KDF_DIGEST_CHECK, '-',
- "Enable digest check for TLS13-KDF"},
- {"tls1_prf_digest_check", OPT_TLS1_PRF_DIGEST_CHECK, '-',
- "Enable digest check for TLS1-PRF"},
- {"sshkdf_digest_check", OPT_SSHKDF_DIGEST_CHECK, '-',
- "Enable digest check for SSHKDF"},
- {"sskdf_digest_check", OPT_SSKDF_DIGEST_CHECK, '-',
- "Enable digest check for SSKDF"},
- {"x963kdf_digest_check", OPT_X963KDF_DIGEST_CHECK, '-',
- "Enable digest check for X963KDF"},
- {"dsa_sign_disabled", OPT_DISALLOW_DSA_SIGN, '-',
- "Disallow DSA signing"},
- {"tdes_encrypt_disabled", OPT_DISALLOW_TDES_ENCRYPT, '-',
- "Disallow Triple-DES encryption"},
- {"rsa_pkcs15_padding_disabled", OPT_DISALLOW_PKCS15_PADDING, '-',
- "Disallow PKCS#1 version 1.5 padding for RSA encryption"},
- {"rsa_pss_saltlen_check", OPT_RSA_PSS_SALTLEN_CHECK, '-',
- "Enable salt length check for RSA-PSS signature operations"},
- {"rsa_sign_x931_disabled", OPT_DISALLOW_SIGNATURE_X931_PADDING, '-',
- "Disallow X931 Padding for RSA signing"},
- {"hkdf_key_check", OPT_HKDF_KEY_CHECK, '-',
- "Enable key check for HKDF"},
- {"kbkdf_key_check", OPT_KBKDF_KEY_CHECK, '-',
- "Enable key check for KBKDF"},
- {"tls13_kdf_key_check", OPT_TLS13_KDF_KEY_CHECK, '-',
- "Enable key check for TLS13-KDF"},
- {"tls1_prf_key_check", OPT_TLS1_PRF_KEY_CHECK, '-',
- "Enable key check for TLS1-PRF"},
- {"sshkdf_key_check", OPT_SSHKDF_KEY_CHECK, '-',
- "Enable key check for SSHKDF"},
- {"sskdf_key_check", OPT_SSKDF_KEY_CHECK, '-',
- "Enable key check for SSKDF"},
- {"x963kdf_key_check", OPT_X963KDF_KEY_CHECK, '-',
- "Enable key check for X963KDF"},
- {"x942kdf_key_check", OPT_X942KDF_KEY_CHECK, '-',
- "Enable key check for X942KDF"},
- {"no_pbkdf2_lower_bound_check", OPT_NO_PBKDF2_LOWER_BOUND_CHECK, '-',
- "Disable lower bound check for PBKDF2"},
- {"ecdh_cofactor_check", OPT_ECDH_COFACTOR_CHECK, '-',
- "Enable Cofactor check for ECDH"},
+ { "help", OPT_HELP, '-', "Display this summary" },
+ { "pedantic", OPT_PEDANTIC, '-', "Set options for strict FIPS compliance" },
+ { "verify", OPT_VERIFY, '-',
+ "Verify a config file instead of generating one" },
+ { "module", OPT_MODULE, '<', "File name of the provider module" },
+ { "provider_name", OPT_PROV_NAME, 's', "FIPS provider name" },
+ { "section_name", OPT_SECTION_NAME, 's',
+ "FIPS Provider config section name (optional)" },
+ { "no_conditional_errors", OPT_NO_CONDITIONAL_ERRORS, '-',
+ "Disable the ability of the fips module to enter an error state if"
+ " any conditional self tests fail" },
+ { "no_security_checks", OPT_NO_SECURITY_CHECKS, '-',
+ "Disable the run-time FIPS security checks in the module" },
+ { "self_test_onload", OPT_SELF_TEST_ONLOAD, '-',
+ "Forces self tests to always run on module load" },
+ { "self_test_oninstall", OPT_SELF_TEST_ONINSTALL, '-',
+ "Forces self tests to run once on module installation" },
+ { "ems_check", OPT_TLS_PRF_EMS_CHECK, '-',
+ "Enable the run-time FIPS check for EMS during TLS1_PRF" },
+ { "no_short_mac", OPT_NO_SHORT_MAC, '-', "Disallow short MAC output" },
+ { "no_drbg_truncated_digests", OPT_DISALLOW_DRGB_TRUNC_DIGEST, '-',
+ "Disallow truncated digests with Hash and HMAC DRBGs" },
+ { "signature_digest_check", OPT_SIGNATURE_DIGEST_CHECK, '-',
+ "Enable checking for approved digests for signatures" },
+ { "hmac_key_check", OPT_HMAC_KEY_CHECK, '-', "Enable key check for HMAC" },
+ { "kmac_key_check", OPT_KMAC_KEY_CHECK, '-', "Enable key check for KMAC" },
+ { "hkdf_digest_check", OPT_HKDF_DIGEST_CHECK, '-',
+ "Enable digest check for HKDF" },
+ { "tls13_kdf_digest_check", OPT_TLS13_KDF_DIGEST_CHECK, '-',
+ "Enable digest check for TLS13-KDF" },
+ { "tls1_prf_digest_check", OPT_TLS1_PRF_DIGEST_CHECK, '-',
+ "Enable digest check for TLS1-PRF" },
+ { "sshkdf_digest_check", OPT_SSHKDF_DIGEST_CHECK, '-',
+ "Enable digest check for SSHKDF" },
+ { "sskdf_digest_check", OPT_SSKDF_DIGEST_CHECK, '-',
+ "Enable digest check for SSKDF" },
+ { "x963kdf_digest_check", OPT_X963KDF_DIGEST_CHECK, '-',
+ "Enable digest check for X963KDF" },
+ { "dsa_sign_disabled", OPT_DISALLOW_DSA_SIGN, '-',
+ "Disallow DSA signing" },
+ { "tdes_encrypt_disabled", OPT_DISALLOW_TDES_ENCRYPT, '-',
+ "Disallow Triple-DES encryption" },
+ { "rsa_pkcs15_padding_disabled", OPT_DISALLOW_PKCS15_PADDING, '-',
+ "Disallow PKCS#1 version 1.5 padding for RSA encryption" },
+ { "rsa_pss_saltlen_check", OPT_RSA_PSS_SALTLEN_CHECK, '-',
+ "Enable salt length check for RSA-PSS signature operations" },
+ { "rsa_sign_x931_disabled", OPT_DISALLOW_SIGNATURE_X931_PADDING, '-',
+ "Disallow X931 Padding for RSA signing" },
+ { "hkdf_key_check", OPT_HKDF_KEY_CHECK, '-',
+ "Enable key check for HKDF" },
+ { "kbkdf_key_check", OPT_KBKDF_KEY_CHECK, '-',
+ "Enable key check for KBKDF" },
+ { "tls13_kdf_key_check", OPT_TLS13_KDF_KEY_CHECK, '-',
+ "Enable key check for TLS13-KDF" },
+ { "tls1_prf_key_check", OPT_TLS1_PRF_KEY_CHECK, '-',
+ "Enable key check for TLS1-PRF" },
+ { "sshkdf_key_check", OPT_SSHKDF_KEY_CHECK, '-',
+ "Enable key check for SSHKDF" },
+ { "sskdf_key_check", OPT_SSKDF_KEY_CHECK, '-',
+ "Enable key check for SSKDF" },
+ { "x963kdf_key_check", OPT_X963KDF_KEY_CHECK, '-',
+ "Enable key check for X963KDF" },
+ { "x942kdf_key_check", OPT_X942KDF_KEY_CHECK, '-',
+ "Enable key check for X942KDF" },
+ { "no_pbkdf2_lower_bound_check", OPT_NO_PBKDF2_LOWER_BOUND_CHECK, '-',
+ "Disable lower bound check for PBKDF2" },
+ { "ecdh_cofactor_check", OPT_ECDH_COFACTOR_CHECK, '-',
+ "Enable Cofactor check for ECDH" },
OPT_SECTION("Input"),
- {"in", OPT_IN, '<', "Input config file, used when verifying"},
+ { "in", OPT_IN, '<', "Input config file, used when verifying" },
OPT_SECTION("Output"),
- {"out", OPT_OUT, '>', "Output config file, used when generating"},
- {"mac_name", OPT_MAC_NAME, 's', "MAC name"},
- {"macopt", OPT_MACOPT, 's', "MAC algorithm parameters in n:v form."},
- {OPT_MORE_STR, 0, 0, "See 'PARAMETER NAMES' in the EVP_MAC_ docs"},
- {"noout", OPT_NO_LOG, '-', "Disable logging of self test events"},
- {"corrupt_desc", OPT_CORRUPT_DESC, 's', "Corrupt a self test by description"},
- {"corrupt_type", OPT_CORRUPT_TYPE, 's', "Corrupt a self test by type"},
- {"config", OPT_CONFIG, '<', "The parent config to verify"},
- {"quiet", OPT_QUIET, '-', "No messages, just exit status"},
- {NULL}
+ { "out", OPT_OUT, '>', "Output config file, used when generating" },
+ { "mac_name", OPT_MAC_NAME, 's', "MAC name" },
+ { "macopt", OPT_MACOPT, 's', "MAC algorithm parameters in n:v form." },
+ { OPT_MORE_STR, 0, 0, "See 'PARAMETER NAMES' in the EVP_MAC_ docs" },
+ { "noout", OPT_NO_LOG, '-', "Disable logging of self test events" },
+ { "corrupt_desc", OPT_CORRUPT_DESC, 's', "Corrupt a self test by description" },
+ { "corrupt_type", OPT_CORRUPT_TYPE, 's', "Corrupt a self test by type" },
+ { "config", OPT_CONFIG, '<', "The parent config to verify" },
+ { "quiet", OPT_QUIET, '-', "No messages, just exit status" },
+ { NULL }
};
typedef struct {
@@ -186,70 +201,70 @@ typedef struct {
/* Pedantic FIPS compliance */
static const FIPS_OPTS pedantic_opts = {
- 1, /* self_test_onload */
- 1, /* conditional_errors */
- 1, /* security_checks */
- 1, /* hmac_key_check */
- 1, /* kmac_key_check */
- 1, /* tls_prf_ems_check */
- 1, /* no_short_mac */
- 1, /* drgb_no_trunc_dgst */
- 1, /* signature_digest_check */
- 1, /* hkdf_digest_check */
- 1, /* tls13_kdf_digest_check */
- 1, /* tls1_prf_digest_check */
- 1, /* sshkdf_digest_check */
- 1, /* sskdf_digest_check */
- 1, /* x963kdf_digest_check */
- 1, /* dsa_sign_disabled */
- 1, /* tdes_encrypt_disabled */
- 1, /* rsa_pkcs15_padding_disabled */
- 1, /* rsa_pss_saltlen_check */
- 1, /* sign_x931_padding_disabled */
- 1, /* hkdf_key_check */
- 1, /* kbkdf_key_check */
- 1, /* tls13_kdf_key_check */
- 1, /* tls1_prf_key_check */
- 1, /* sshkdf_key_check */
- 1, /* sskdf_key_check */
- 1, /* x963kdf_key_check */
- 1, /* x942kdf_key_check */
- 1, /* pbkdf2_lower_bound_check */
- 1, /* ecdh_cofactor_check */
+ 1, /* self_test_onload */
+ 1, /* conditional_errors */
+ 1, /* security_checks */
+ 1, /* hmac_key_check */
+ 1, /* kmac_key_check */
+ 1, /* tls_prf_ems_check */
+ 1, /* no_short_mac */
+ 1, /* drgb_no_trunc_dgst */
+ 1, /* signature_digest_check */
+ 1, /* hkdf_digest_check */
+ 1, /* tls13_kdf_digest_check */
+ 1, /* tls1_prf_digest_check */
+ 1, /* sshkdf_digest_check */
+ 1, /* sskdf_digest_check */
+ 1, /* x963kdf_digest_check */
+ 1, /* dsa_sign_disabled */
+ 1, /* tdes_encrypt_disabled */
+ 1, /* rsa_pkcs15_padding_disabled */
+ 1, /* rsa_pss_saltlen_check */
+ 1, /* sign_x931_padding_disabled */
+ 1, /* hkdf_key_check */
+ 1, /* kbkdf_key_check */
+ 1, /* tls13_kdf_key_check */
+ 1, /* tls1_prf_key_check */
+ 1, /* sshkdf_key_check */
+ 1, /* sskdf_key_check */
+ 1, /* x963kdf_key_check */
+ 1, /* x942kdf_key_check */
+ 1, /* pbkdf2_lower_bound_check */
+ 1, /* ecdh_cofactor_check */
};
/* Default FIPS settings for backward compatibility */
static FIPS_OPTS fips_opts = {
- 1, /* self_test_onload */
- 1, /* conditional_errors */
- 1, /* security_checks */
- 0, /* hmac_key_check */
- 0, /* kmac_key_check */
- 0, /* tls_prf_ems_check */
- 0, /* no_short_mac */
- 0, /* drgb_no_trunc_dgst */
- 0, /* signature_digest_check */
- 0, /* hkdf_digest_check */
- 0, /* tls13_kdf_digest_check */
- 0, /* tls1_prf_digest_check */
- 0, /* sshkdf_digest_check */
- 0, /* sskdf_digest_check */
- 0, /* x963kdf_digest_check */
- 0, /* dsa_sign_disabled */
- 0, /* tdes_encrypt_disabled */
- 0, /* rsa_pkcs15_padding_disabled */
- 0, /* rsa_pss_saltlen_check */
- 0, /* sign_x931_padding_disabled */
- 0, /* hkdf_key_check */
- 0, /* kbkdf_key_check */
- 0, /* tls13_kdf_key_check */
- 0, /* tls1_prf_key_check */
- 0, /* sshkdf_key_check */
- 0, /* sskdf_key_check */
- 0, /* x963kdf_key_check */
- 0, /* x942kdf_key_check */
- 1, /* pbkdf2_lower_bound_check */
- 0, /* ecdh_cofactor_check */
+ 1, /* self_test_onload */
+ 1, /* conditional_errors */
+ 1, /* security_checks */
+ 0, /* hmac_key_check */
+ 0, /* kmac_key_check */
+ 0, /* tls_prf_ems_check */
+ 0, /* no_short_mac */
+ 0, /* drgb_no_trunc_dgst */
+ 0, /* signature_digest_check */
+ 0, /* hkdf_digest_check */
+ 0, /* tls13_kdf_digest_check */
+ 0, /* tls1_prf_digest_check */
+ 0, /* sshkdf_digest_check */
+ 0, /* sskdf_digest_check */
+ 0, /* x963kdf_digest_check */
+ 0, /* dsa_sign_disabled */
+ 0, /* tdes_encrypt_disabled */
+ 0, /* rsa_pkcs15_padding_disabled */
+ 0, /* rsa_pss_saltlen_check */
+ 0, /* sign_x931_padding_disabled */
+ 0, /* hkdf_key_check */
+ 0, /* kbkdf_key_check */
+ 0, /* tls13_kdf_key_check */
+ 0, /* tls1_prf_key_check */
+ 0, /* sshkdf_key_check */
+ 0, /* sskdf_key_check */
+ 0, /* x963kdf_key_check */
+ 0, /* x942kdf_key_check */
+ 1, /* pbkdf2_lower_bound_check */
+ 0, /* ecdh_cofactor_check */
};
static int check_non_pedantic_fips(int pedantic, const char *name)
@@ -262,7 +277,7 @@ static int check_non_pedantic_fips(int pedantic, const char *name)
}
static int do_mac(EVP_MAC_CTX *ctx, unsigned char *tmp, BIO *in,
- unsigned char *out, size_t *out_len)
+ unsigned char *out, size_t *out_len)
{
int ret = 0;
int i;
@@ -285,7 +300,7 @@ err:
}
static int load_fips_prov_and_run_self_test(const char *prov_name,
- int *is_fips_140_2_prov)
+ int *is_fips_140_2_prov)
{
int ret = 0;
OSSL_PROVIDER *prov = NULL;
@@ -299,11 +314,11 @@ static int load_fips_prov_and_run_self_test(const char *prov_name,
}
if (!quiet) {
*p++ = OSSL_PARAM_construct_utf8_ptr(OSSL_PROV_PARAM_NAME,
- &name, sizeof(name));
+ &name, sizeof(name));
*p++ = OSSL_PARAM_construct_utf8_ptr(OSSL_PROV_PARAM_VERSION,
- &vers, sizeof(vers));
+ &vers, sizeof(vers));
*p++ = OSSL_PARAM_construct_utf8_ptr(OSSL_PROV_PARAM_BUILDINFO,
- &build, sizeof(build));
+ &build, sizeof(build));
*p = OSSL_PARAM_construct_end();
if (!OSSL_PROVIDER_get_params(prov, params)) {
BIO_printf(bio_err, "Failed to query FIPS module parameters\n");
@@ -317,7 +332,7 @@ static int load_fips_prov_and_run_self_test(const char *prov_name,
BIO_printf(bio_err, "\t%-10s\t%s\n", "build:", build);
} else {
*p++ = OSSL_PARAM_construct_utf8_ptr(OSSL_PROV_PARAM_VERSION,
- &vers, sizeof(vers));
+ &vers, sizeof(vers));
*p = OSSL_PARAM_construct_end();
if (!OSSL_PROVIDER_get_params(prov, params)) {
BIO_printf(bio_err, "Failed to query FIPS module parameters\n");
@@ -332,7 +347,7 @@ end:
}
static int print_mac(BIO *bio, const char *label, const unsigned char *mac,
- size_t len)
+ size_t len)
{
int ret;
char *hexstr = NULL;
@@ -346,13 +361,13 @@ static int print_mac(BIO *bio, const char *label, const unsigned char *mac,
}
static int write_config_header(BIO *out, const char *prov_name,
- const char *section)
+ const char *section)
{
return BIO_printf(out, "openssl_conf = openssl_init\n\n")
- && BIO_printf(out, "[openssl_init]\n")
- && BIO_printf(out, "providers = provider_section\n\n")
- && BIO_printf(out, "[provider_section]\n")
- && BIO_printf(out, "%s = %s\n\n", prov_name, section);
+ && BIO_printf(out, "[openssl_init]\n")
+ && BIO_printf(out, "providers = provider_section\n\n")
+ && BIO_printf(out, "[provider_section]\n")
+ && BIO_printf(out, "%s = %s\n\n", prov_name, section);
}
/*
@@ -363,96 +378,127 @@ static int write_config_header(BIO *out, const char *prov_name,
* Returns 1 if the config file is written otherwise it returns 0 on error.
*/
static int write_config_fips_section(BIO *out, const char *section,
- unsigned char *module_mac,
- size_t module_mac_len,
- const FIPS_OPTS *opts,
- unsigned char *install_mac,
- size_t install_mac_len)
+ unsigned char *module_mac,
+ size_t module_mac_len,
+ const FIPS_OPTS *opts,
+ unsigned char *install_mac,
+ size_t install_mac_len)
{
int ret = 0;
if (BIO_printf(out, "[%s]\n", section) <= 0
|| BIO_printf(out, "activate = 1\n") <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_FIPS_PARAM_INSTALL_VERSION,
- VERSION_VAL) <= 0
+ VERSION_VAL)
+ <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_FIPS_PARAM_CONDITIONAL_ERRORS,
- opts->conditional_errors ? "1" : "0") <= 0
+ opts->conditional_errors ? "1" : "0")
+ <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_SECURITY_CHECKS,
- opts->security_checks ? "1" : "0") <= 0
+ opts->security_checks ? "1" : "0")
+ <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_HMAC_KEY_CHECK,
- opts->hmac_key_check ? "1": "0") <= 0
+ opts->hmac_key_check ? "1" : "0")
+ <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_KMAC_KEY_CHECK,
- opts->kmac_key_check ? "1": "0") <= 0
+ opts->kmac_key_check ? "1" : "0")
+ <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_TLS1_PRF_EMS_CHECK,
- opts->tls_prf_ems_check ? "1" : "0") <= 0
+ opts->tls_prf_ems_check ? "1" : "0")
+ <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_NO_SHORT_MAC,
- opts->no_short_mac ? "1" : "0") <= 0
+ opts->no_short_mac ? "1" : "0")
+ <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_DRBG_TRUNC_DIGEST,
- opts->drgb_no_trunc_dgst ? "1" : "0") <= 0
+ opts->drgb_no_trunc_dgst ? "1" : "0")
+ <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_SIGNATURE_DIGEST_CHECK,
- opts->signature_digest_check ? "1" : "0") <= 0
+ opts->signature_digest_check ? "1" : "0")
+ <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_HKDF_DIGEST_CHECK,
- opts->hkdf_digest_check ? "1": "0") <= 0
+ opts->hkdf_digest_check ? "1" : "0")
+ <= 0
|| BIO_printf(out, "%s = %s\n",
- OSSL_PROV_PARAM_TLS13_KDF_DIGEST_CHECK,
- opts->tls13_kdf_digest_check ? "1": "0") <= 0
+ OSSL_PROV_PARAM_TLS13_KDF_DIGEST_CHECK,
+ opts->tls13_kdf_digest_check ? "1" : "0")
+ <= 0
|| BIO_printf(out, "%s = %s\n",
- OSSL_PROV_PARAM_TLS1_PRF_DIGEST_CHECK,
- opts->tls1_prf_digest_check ? "1": "0") <= 0
+ OSSL_PROV_PARAM_TLS1_PRF_DIGEST_CHECK,
+ opts->tls1_prf_digest_check ? "1" : "0")
+ <= 0
|| BIO_printf(out, "%s = %s\n",
- OSSL_PROV_PARAM_SSHKDF_DIGEST_CHECK,
- opts->sshkdf_digest_check ? "1": "0") <= 0
+ OSSL_PROV_PARAM_SSHKDF_DIGEST_CHECK,
+ opts->sshkdf_digest_check ? "1" : "0")
+ <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_SSKDF_DIGEST_CHECK,
- opts->sskdf_digest_check ? "1": "0") <= 0
+ opts->sskdf_digest_check ? "1" : "0")
+ <= 0
|| BIO_printf(out, "%s = %s\n",
- OSSL_PROV_PARAM_X963KDF_DIGEST_CHECK,
- opts->x963kdf_digest_check ? "1": "0") <= 0
+ OSSL_PROV_PARAM_X963KDF_DIGEST_CHECK,
+ opts->x963kdf_digest_check ? "1" : "0")
+ <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_DSA_SIGN_DISABLED,
- opts->dsa_sign_disabled ? "1" : "0") <= 0
+ opts->dsa_sign_disabled ? "1" : "0")
+ <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_TDES_ENCRYPT_DISABLED,
- opts->tdes_encrypt_disabled ? "1" : "0") <= 0
+ opts->tdes_encrypt_disabled ? "1" : "0")
+ <= 0
|| BIO_printf(out, "%s = %s\n",
- OSSL_PROV_PARAM_RSA_PKCS15_PAD_DISABLED,
- opts->rsa_pkcs15_padding_disabled ? "1" : "0") <= 0
+ OSSL_PROV_PARAM_RSA_PKCS15_PAD_DISABLED,
+ opts->rsa_pkcs15_padding_disabled ? "1" : "0")
+ <= 0
|| BIO_printf(out, "%s = %s\n",
- OSSL_PROV_PARAM_RSA_PSS_SALTLEN_CHECK,
- opts->rsa_pss_saltlen_check ? "1" : "0") <= 0
+ OSSL_PROV_PARAM_RSA_PSS_SALTLEN_CHECK,
+ opts->rsa_pss_saltlen_check ? "1" : "0")
+ <= 0
|| BIO_printf(out, "%s = %s\n",
- OSSL_PROV_PARAM_RSA_SIGN_X931_PAD_DISABLED,
- opts->sign_x931_padding_disabled ? "1" : "0") <= 0
+ OSSL_PROV_PARAM_RSA_SIGN_X931_PAD_DISABLED,
+ opts->sign_x931_padding_disabled ? "1" : "0")
+ <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_HKDF_KEY_CHECK,
- opts->hkdf_key_check ? "1": "0") <= 0
+ opts->hkdf_key_check ? "1" : "0")
+ <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_KBKDF_KEY_CHECK,
- opts->kbkdf_key_check ? "1": "0") <= 0
+ opts->kbkdf_key_check ? "1" : "0")
+ <= 0
|| BIO_printf(out, "%s = %s\n",
- OSSL_PROV_PARAM_TLS13_KDF_KEY_CHECK,
- opts->tls13_kdf_key_check ? "1": "0") <= 0
+ OSSL_PROV_PARAM_TLS13_KDF_KEY_CHECK,
+ opts->tls13_kdf_key_check ? "1" : "0")
+ <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_TLS1_PRF_KEY_CHECK,
- opts->tls1_prf_key_check ? "1": "0") <= 0
+ opts->tls1_prf_key_check ? "1" : "0")
+ <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_SSHKDF_KEY_CHECK,
- opts->sshkdf_key_check ? "1": "0") <= 0
+ opts->sshkdf_key_check ? "1" : "0")
+ <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_SSKDF_KEY_CHECK,
- opts->sskdf_key_check ? "1": "0") <= 0
+ opts->sskdf_key_check ? "1" : "0")
+ <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_X963KDF_KEY_CHECK,
- opts->x963kdf_key_check ? "1": "0") <= 0
+ opts->x963kdf_key_check ? "1" : "0")
+ <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_X942KDF_KEY_CHECK,
- opts->x942kdf_key_check ? "1": "0") <= 0
+ opts->x942kdf_key_check ? "1" : "0")
+ <= 0
|| BIO_printf(out, "%s = %s\n",
- OSSL_PROV_PARAM_PBKDF2_LOWER_BOUND_CHECK,
- opts->pbkdf2_lower_bound_check ? "1" : "0") <= 0
+ OSSL_PROV_PARAM_PBKDF2_LOWER_BOUND_CHECK,
+ opts->pbkdf2_lower_bound_check ? "1" : "0")
+ <= 0
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_ECDH_COFACTOR_CHECK,
- opts->ecdh_cofactor_check ? "1": "0") <= 0
+ opts->ecdh_cofactor_check ? "1" : "0")
+ <= 0
|| !print_mac(out, OSSL_PROV_FIPS_PARAM_MODULE_MAC, module_mac,
- module_mac_len))
+ module_mac_len))
goto end;
if (install_mac != NULL
- && install_mac_len > 0
- && opts->self_test_onload == 0) {
+ && install_mac_len > 0
+ && opts->self_test_onload == 0) {
if (!print_mac(out, OSSL_PROV_FIPS_PARAM_INSTALL_MAC, install_mac,
- install_mac_len)
+ install_mac_len)
|| BIO_printf(out, "%s = %s\n", OSSL_PROV_FIPS_PARAM_INSTALL_STATUS,
- INSTALL_STATUS_VAL) <= 0)
+ INSTALL_STATUS_VAL)
+ <= 0)
goto end;
}
ret = 1;
@@ -461,10 +507,10 @@ end:
}
static CONF *generate_config_and_load(const char *prov_name,
- const char *section,
- unsigned char *module_mac,
- size_t module_mac_len,
- const FIPS_OPTS *opts)
+ const char *section,
+ unsigned char *module_mac,
+ size_t module_mac_len,
+ const FIPS_OPTS *opts)
{
BIO *mem_bio = NULL;
CONF *conf = NULL;
@@ -474,8 +520,8 @@ static CONF *generate_config_and_load(const char *prov_name,
return 0;
if (!write_config_header(mem_bio, prov_name, section)
|| !write_config_fips_section(mem_bio, section,
- module_mac, module_mac_len,
- opts, NULL, 0))
+ module_mac, module_mac_len,
+ opts, NULL, 0))
goto end;
conf = app_load_config_bio(mem_bio, NULL);
@@ -510,8 +556,8 @@ static int verify_module_load(const char *parent_config_file)
* install_mac values, otherwise it returns 0.
*/
static int verify_config(const char *infile, const char *section,
- unsigned char *module_mac, size_t module_mac_len,
- unsigned char *install_mac, size_t install_mac_len)
+ unsigned char *module_mac, size_t module_mac_len,
+ unsigned char *install_mac, size_t install_mac_len)
{
int ret = 0;
char *s = NULL;
@@ -536,8 +582,8 @@ static int verify_config(const char *infile, const char *section,
}
buf1 = OPENSSL_hexstr2buf(s, &len);
if (buf1 == NULL
- || (size_t)len != module_mac_len
- || memcmp(module_mac, buf1, module_mac_len) != 0) {
+ || (size_t)len != module_mac_len
+ || memcmp(module_mac, buf1, module_mac_len) != 0) {
BIO_printf(bio_err, "Module integrity mismatch\n");
goto end;
}
@@ -554,8 +600,8 @@ static int verify_config(const char *infile, const char *section,
}
buf2 = OPENSSL_hexstr2buf(s, &len);
if (buf2 == NULL
- || (size_t)len != install_mac_len
- || memcmp(install_mac, buf2, install_mac_len) != 0) {
+ || (size_t)len != install_mac_len
+ || memcmp(install_mac, buf2, install_mac_len) != 0) {
BIO_printf(bio_err, "Install indicator status mismatch\n");
goto end;
}
@@ -598,7 +644,7 @@ int fipsinstall_main(int argc, char **argv)
switch (o) {
case OPT_EOF:
case OPT_ERR:
- opthelp:
+ opthelp:
BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
goto cleanup;
case OPT_HELP:
@@ -773,7 +819,7 @@ int fipsinstall_main(int argc, char **argv)
ret = OSSL_PROVIDER_available(NULL, prov_name) ? 0 : 1;
if (!quiet) {
BIO_printf(bio_err, "FIPS provider is %s\n",
- ret == 0 ? "available" : "not available");
+ ret == 0 ? "available" : "not available");
}
}
goto end;
@@ -792,8 +838,8 @@ int fipsinstall_main(int argc, char **argv)
}
if (self_test_log
- || self_test_corrupt_desc != NULL
- || self_test_corrupt_type != NULL)
+ || self_test_corrupt_desc != NULL
+ || self_test_corrupt_type != NULL)
OSSL_SELF_TEST_set_callback(NULL, self_test_events, NULL);
/* Use the default FIPS HMAC digest and key if not specified. */
@@ -826,8 +872,7 @@ int fipsinstall_main(int argc, char **argv)
if (opts != NULL) {
int ok = 1;
- OSSL_PARAM *params =
- app_params_new_from_opts(opts, EVP_MAC_settable_ctx_params(mac));
+ OSSL_PARAM *params = app_params_new_from_opts(opts, EVP_MAC_settable_ctx_params(mac));
if (params == NULL)
goto end;
@@ -853,7 +898,7 @@ int fipsinstall_main(int argc, char **argv)
/* Calculate the MAC for the indicator status - it may not be used */
mem_bio = BIO_new_mem_buf((const void *)INSTALL_STATUS_VAL,
- strlen(INSTALL_STATUS_VAL));
+ strlen(INSTALL_STATUS_VAL));
if (mem_bio == NULL) {
BIO_printf(bio_err, "Unable to create memory BIO\n");
goto end;
@@ -865,13 +910,13 @@ int fipsinstall_main(int argc, char **argv)
if (fips_opts.self_test_onload == 1)
install_mac_len = 0;
if (!verify_config(in_fname, section_name, module_mac, module_mac_len,
- install_mac, install_mac_len))
+ install_mac, install_mac_len))
goto end;
if (!quiet)
BIO_printf(bio_err, "VERIFY PASSED\n");
} else {
conf = generate_config_and_load(prov_name, section_name, module_mac,
- module_mac_len, &fips_opts);
+ module_mac_len, &fips_opts);
if (conf == NULL)
goto end;
if (!load_fips_prov_and_run_self_test(prov_name, &is_fips_140_2_prov))
@@ -888,17 +933,16 @@ int fipsinstall_main(int argc, char **argv)
if (set_selftest_onload_option == 0 && is_fips_140_2_prov)
fips_opts.self_test_onload = 0;
- fout =
- out_fname == NULL ? dup_bio_out(FORMAT_TEXT)
- : bio_open_default(out_fname, 'w', FORMAT_TEXT);
+ fout = out_fname == NULL ? dup_bio_out(FORMAT_TEXT)
+ : bio_open_default(out_fname, 'w', FORMAT_TEXT);
if (fout == NULL) {
BIO_printf(bio_err, "Failed to open file\n");
goto end;
}
if (!write_config_fips_section(fout, section_name,
- module_mac, module_mac_len, &fips_opts,
- install_mac, install_mac_len))
+ module_mac, module_mac_len, &fips_opts,
+ install_mac, install_mac_len))
goto end;
if (!quiet)
BIO_printf(bio_err, "INSTALL PASSED\n");
@@ -951,7 +995,7 @@ static int self_test_events(const OSSL_PARAM params[], void *arg)
if (strcmp(phase, OSSL_SELF_TEST_PHASE_START) == 0)
BIO_printf(bio_err, "%s : (%s) : ", desc, type);
else if (strcmp(phase, OSSL_SELF_TEST_PHASE_PASS) == 0
- || strcmp(phase, OSSL_SELF_TEST_PHASE_FAIL) == 0)
+ || strcmp(phase, OSSL_SELF_TEST_PHASE_FAIL) == 0)
BIO_printf(bio_err, "%s\n", phase);
}
/*
@@ -959,13 +1003,13 @@ static int self_test_events(const OSSL_PARAM params[], void *arg)
* error is returned during the corrupt phase.
*/
if (strcmp(phase, OSSL_SELF_TEST_PHASE_CORRUPT) == 0
- && (self_test_corrupt_desc != NULL
- || self_test_corrupt_type != NULL)) {
+ && (self_test_corrupt_desc != NULL
+ || self_test_corrupt_type != NULL)) {
if (self_test_corrupt_desc != NULL
- && strcmp(self_test_corrupt_desc, desc) != 0)
+ && strcmp(self_test_corrupt_desc, desc) != 0)
goto end;
if (self_test_corrupt_type != NULL
- && strcmp(self_test_corrupt_type, type) != 0)
+ && strcmp(self_test_corrupt_type, type) != 0)
goto end;
BIO_printf(bio_err, "%s ", phase);
goto err;
generated by cgit v1.2.3 (git 2.25.1) at 2026-04-25 01:36:29 +0000