Skip to content

Commit ff4bde3

Browse files
cconloncconlon
authored
Merge pull request #128 from haydenroche5/fips_restrictions
Allow user to enable/disable individual FIPS checks.
2 parents 135f7d1 + d18ff51 commit ff4bde3

File tree

10 files changed

+123
-34
lines changed

10 files changed

+123
-34
lines changed

‎include/include.am‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,8 @@
33
#
44

55
noinst_HEADERS += include/wolfengine/we_internal.h \
6-
include/wolfengine/we_logging.h \
7-
include/wolfengine/we_openssl_bc.h
6+
include/wolfengine/we_openssl_bc.h
87

9-
pkginclude_HEADERS = include/wolfengine/we_wolfengine.h
8+
pkginclude_HEADERS = include/wolfengine/we_wolfengine.h \
9+
include/wolfengine/we_logging.h \
10+
include/wolfengine/we_fips.h

‎include/wolfengine/we_fips.h‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
/* we_fips.h
2+
*
3+
* Copyright (C) 2019-2021 wolfSSL Inc.
4+
*
5+
* This file is part of wolfengine.
6+
*
7+
* wolfengine is free software; you can redistribute it and/or modify
8+
* it under the terms of the GNU General Public License as published by
9+
* the Free Software Foundation; either version 2 of the License, or
10+
* (at your option) any later version.
11+
*
12+
* wolfengine is distributed in the hope that it will be useful,
13+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
14+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15+
* GNU General Public License for more details.
16+
*
17+
* You should have received a copy of the GNU General Public License
18+
* along with this program; if not, write to the Free Software
19+
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
20+
*/
21+
22+
#ifndef WE_FIPS_H
23+
#define WE_FIPS_H
24+
25+
#ifdef WOLFENGINE_USER_SETTINGS
26+
#include "user_settings.h"
27+
#endif
28+
29+
#include <wolfssl/options.h>
30+
31+
enum wolfEngine_FipsCheck {
32+
/* check that RSA key size is valid */
33+
WE_FIPS_CHECK_RSA_KEY_SIZE = 0x0001,
34+
/* check that P-192 usage is valid */
35+
WE_FIPS_CHECK_P192 = 0x0002,
36+
/* check that RSA signature with SHA-1 digest is valid */
37+
WE_FIPS_CHECK_RSA_SHA1 = 0x0004,
38+
39+
/* default FIPS checks (all with wolfCrypt FIPS, none without) */
40+
#if defined(HAVE_FIPS) || defined(HAVE_FIPS_VERSION)
41+
WE_FIPS_CHECKS_DEFAULT = (WE_FIPS_CHECK_RSA_KEY_SIZE
42+
| WE_FIPS_CHECK_P192
43+
| WE_FIPS_CHECK_RSA_SHA1)
44+
#else
45+
WE_FIPS_CHECKS_DEFAULT = 0
46+
#endif /* HAVE_FIPS || HAVE_FIPS_VERSION */
47+
};
48+
49+
/* Set FIPS checks, bitmask of wolfEngine_FipsCheck. */
50+
void wolfEngine_SetFipsChecks(long checksMask);
51+
/* Get FIPS checks mask. */
52+
long wolfEngine_GetFipsChecks(void);
53+
54+
#endif /* WE_FIPS_H */

‎include/wolfengine/we_internal.h‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,7 @@
7979
#include <wolfengine/we_openssl_bc.h>
8080

8181
#include <wolfengine/we_logging.h>
82+
#include <wolfengine/we_fips.h>
8283

8384
#if defined(__IAR_SYSTEMS_ICC__) || defined(__GNUC__)
8485
/* Function is a printf style function. Pretend parameter is string literal.
@@ -91,13 +92,6 @@
9192
#define WE_PRINTF_FUNC(s, v)
9293
#endif
9394

94-
#if defined(HAVE_FIPS) || defined(HAVE_FIPS_VERSION)
95-
/*
96-
* Global FIPS checks flag.
97-
*/
98-
extern int fipsChecks;
99-
#endif /* HAVE_FIPS || HAVE_FIPS_VERSION */
100-
10195
/*
10296
* Global random
10397
*/

‎src/include.am‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,4 +22,4 @@ libwolfengine_la_SOURCES += src/we_random.c
2222
libwolfengine_la_SOURCES += src/we_rsa.c
2323
libwolfengine_la_SOURCES += src/we_tls_prf.c
2424
libwolfengine_la_SOURCES += src/we_wolfengine.c
25-
25+
libwolfengine_la_SOURCES += src/we_fips.c

‎src/we_ecc.c‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,12 +41,11 @@ static int we_ecc_check_curve_usage(int curveId) {
4141

4242
WOLFENGINE_ENTER(WE_LOG_PK, "we_ecc_check_curve_usage");
4343

44-
#if defined(HAVE_FIPS) || defined(HAVE_FIPS_VERSION)
45-
if (fipsChecks == 1 && curveId == ECC_SECP192R1) {
44+
if ((wolfEngine_GetFipsChecks() & WE_FIPS_CHECK_P192) &&
45+
(curveId == ECC_SECP192R1)) {
4646
ret = 0;
4747
WOLFENGINE_ERROR_MSG(WE_LOG_PK, "P-192 isn't allowed in FIPS mode.");
4848
}
49-
#endif /* HAVE_FIPS || HAVE_FIPS_VERSION */
5049

5150
WOLFENGINE_LEAVE(WE_LOG_PK, "we_ecc_check_curve_usage", ret);
5251

‎src/we_fips.c‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
/* we_fips.c
2+
*
3+
* Copyright (C) 2006-2021 wolfSSL Inc.
4+
*
5+
* This file is part of wolfengine.
6+
*
7+
* wolfengine is free software; you can redistribute it and/or modify
8+
* it under the terms of the GNU General Public License as published by
9+
* the Free Software Foundation; either version 2 of the License, or
10+
* (at your option) any later version.
11+
*
12+
* wolfengine is distributed in the hope that it will be useful,
13+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
14+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15+
* GNU General Public License for more details.
16+
*
17+
* You should have received a copy of the GNU General Public License
18+
* along with this program; if not, write to the Free Software
19+
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
20+
*/
21+
22+
#include <wolfengine/we_fips.h>
23+
24+
/* Bitmask of FIPS checks in wolfEngine_FipsCheck. Can be set by application
25+
* through ENGINE_ctrl command. Defaults to all checks if using wolfCrypt FIPS
26+
* and no checks if not. */
27+
static long fipsChecks = WE_FIPS_CHECKS_DEFAULT;
28+
29+
/**
30+
* Set wolfEngine FIPS checks.
31+
* Default FIPS checks for wolfEngine is WE_FIPS_CHECKS_DEFAULT.
32+
*
33+
* @param checksMask [in] Bitmask of FIPS checks from wolfEngine_FipsCheck in
34+
* we_fips.h.
35+
*/
36+
void wolfEngine_SetFipsChecks(long checksMask)
37+
{
38+
fipsChecks = checksMask;
39+
}
40+
41+
/**
42+
* Get wolfEngine FIPS checks mask.
43+
*
44+
* @return The FIPS checks mask.
45+
*/
46+
long wolfEngine_GetFipsChecks()
47+
{
48+
return fipsChecks;
49+
}

‎src/we_internal.c‎

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,6 @@
2222
#include <wolfengine/we_wolfengine.h>
2323
#include <wolfengine/we_internal.h>
2424

25-
#if defined(HAVE_FIPS) || defined(HAVE_FIPS_VERSION)
26-
int fipsChecks = 1;
27-
#endif /* HAVE_FIPS || HAVE_FIPS_VERSION */
28-
2925
/** Engine bound to. */
3026
static ENGINE *bound = NULL;
3127

@@ -1194,12 +1190,7 @@ static int wolfengine_ctrl(ENGINE* e, int cmd, long i, void* p,
11941190
break;
11951191
case WOLFENGINE_CMD_ENABLE_FIPS_CHECKS:
11961192
#if defined(HAVE_FIPS) || defined(HAVE_FIPS_VERSION)
1197-
if (i > 0) {
1198-
fipsChecks = 1;
1199-
}
1200-
else {
1201-
fipsChecks = 0;
1202-
}
1193+
wolfEngine_SetFipsChecks(i);
12031194
#else
12041195
WOLFENGINE_MSG(WE_LOG_ENGINE, "Control command "
12051196
"WOLFENGINE_CMD_ENABLE_FIPS_CHECKS has no effect when "

‎src/we_logging.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,7 @@ void wolfEngine_Debugging_OFF(void)
102102

103103
/**
104104
* Set wolfEngine logging level.
105-
* Deafult logging level for wolfEngine is WE_LOG_LEVEL_DEFAULT.
105+
* Default logging level for wolfEngine is WE_LOG_LEVEL_DEFAULT.
106106
*
107107
* @param levelMask [IN] Bitmask of logging levels from wolfEngine_LogType
108108
* in we_logging.h.

‎src/we_rsa.c‎

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -84,16 +84,13 @@ static int we_check_rsa_key_size(int size, int allow1024) {
8484
int ret = 0;
8585
char errBuff[WOLFENGINE_MAX_LOG_WIDTH];
8686

87-
#if defined(HAVE_FIPS) || defined(HAVE_FIPS_VERSION)
88-
if (fipsChecks == 1) {
87+
if (wolfEngine_GetFipsChecks() & WE_FIPS_CHECK_RSA_KEY_SIZE) {
8988
ret = size == 2048 || size == 3072 || size == 4096;
9089
if (allow1024 == 1) {
9190
ret |= size == 1024;
9291
}
9392
}
94-
else
95-
#endif /* HAVE_FIPS || HAVE_FIPS_VERSION */
96-
{
93+
else {
9794
(void)allow1024;
9895
ret = size >= RSA_MIN_SIZE && size <= RSA_MAX_SIZE;
9996

@@ -121,12 +118,11 @@ static int we_check_rsa_signing_md(int nid) {
121118

122119
WOLFENGINE_ENTER(WE_LOG_PK, "we_check_rsa_md");
123120

124-
#if defined(HAVE_FIPS) || defined(HAVE_FIPS_VERSION)
125-
if (fipsChecks == 1 && nid == NID_sha1) {
121+
if ((wolfEngine_GetFipsChecks() & WE_FIPS_CHECK_RSA_SHA1) &&
122+
(nid == NID_sha1)) {
126123
ret = 0;
127124
WOLFENGINE_ERROR_MSG(WE_LOG_PK, "SHA-1 isn't allowed in FIPS mode.");
128125
}
129-
#endif /* HAVE_FIPS || HAVE_FIPS_VERSION */
130126

131127
WOLFENGINE_LEAVE(WE_LOG_PK, "we_check_rsa_md", ret);
132128

‎test/test_rsa.c‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
*/
2121

2222
#include "unit.h"
23+
#include <wolfengine/we_fips.h>
2324

2425
#ifdef WE_HAVE_RSA
2526

@@ -608,11 +609,15 @@ int test_rsa_direct_key_gen(ENGINE *e, void *data)
608609
if (err == 0) {
609610
PRINT_MSG("Check that re-enabling FIPS checks disallows 1024-bit key "
610611
"gen.");
611-
err = ENGINE_ctrl_cmd(e, "enable_fips_checks", 1, NULL, NULL, 0) == 0;
612+
err = ENGINE_ctrl_cmd(e, "enable_fips_checks",
613+
WE_FIPS_CHECK_RSA_KEY_SIZE, NULL, NULL, 0) == 0;
612614
}
613615
if (err == 0) {
614616
err = RSA_generate_key_ex(rsaKey, 1024, pubExp, NULL) != 0;
615617
}
618+
/* Restore all FIPS checks. */
619+
ENGINE_ctrl_cmd(e, "enable_fips_checks", WE_FIPS_CHECKS_DEFAULT, NULL, NULL,
620+
0);
616621
#endif /* HAVE_FIPS || HAVE_FIPS_VERSION */
617622

618623
if (pubExp != NULL) {

0 commit comments

Comments
 (0)