1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
|
/*
* Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include <string.h>
#include <stdio.h>
#include <openssl/core.h>
#include <openssl/core_numbers.h>
#include <openssl/core_names.h>
#include <openssl/params.h>
#include <openssl/err.h>
#include <openssl/evp.h>
/* TODO(3.0): Needed for dummy_evp_call(). To be removed */
#include <openssl/sha.h>
#include "internal/cryptlib.h"
#include "internal/property.h"
#include "internal/evp_int.h"
/* Functions provided by the core */
static OSSL_core_get_param_types_fn *c_get_param_types = NULL;
static OSSL_core_get_params_fn *c_get_params = NULL;
static OSSL_core_put_error_fn *c_put_error = NULL;
static OSSL_core_add_error_vdata_fn *c_add_error_vdata = NULL;
/* Parameters we provide to the core */
static const OSSL_ITEM fips_param_types[] = {
{ OSSL_PARAM_UTF8_PTR, OSSL_PROV_PARAM_NAME },
{ OSSL_PARAM_UTF8_PTR, OSSL_PROV_PARAM_VERSION },
{ OSSL_PARAM_UTF8_PTR, OSSL_PROV_PARAM_BUILDINFO },
{ 0, NULL }
};
/* TODO(3.0): To be removed */
static int dummy_evp_call(OPENSSL_CTX *libctx)
{
EVP_MD_CTX *ctx = EVP_MD_CTX_new();
EVP_MD *sha256 = EVP_MD_fetch(libctx, "SHA256", NULL);
char msg[] = "Hello World!";
const unsigned char exptd[] = {
0x7f, 0x83, 0xb1, 0x65, 0x7f, 0xf1, 0xfc, 0x53, 0xb9, 0x2d, 0xc1, 0x81,
0x48, 0xa1, 0xd6, 0x5d, 0xfc, 0x2d, 0x4b, 0x1f, 0xa3, 0xd6, 0x77, 0x28,
0x4a, 0xdd, 0xd2, 0x00, 0x12, 0x6d, 0x90, 0x69
};
unsigned int dgstlen = 0;
unsigned char dgst[SHA256_DIGEST_LENGTH];
int ret = 0;
if (ctx == NULL || sha256 == NULL)
goto err;
if (!EVP_DigestInit_ex(ctx, sha256, NULL))
goto err;
if (!EVP_DigestUpdate(ctx, msg, sizeof(msg) - 1))
goto err;
if (!EVP_DigestFinal(ctx, dgst, &dgstlen))
goto err;
if (dgstlen != sizeof(exptd) || memcmp(dgst, exptd, sizeof(exptd)) != 0)
goto err;
ret = 1;
err:
EVP_MD_CTX_free(ctx);
EVP_MD_meth_free(sha256);
return ret;
}
static const OSSL_ITEM *fips_get_param_types(const OSSL_PROVIDER *prov)
{
return fips_param_types;
}
static int fips_get_params(const OSSL_PROVIDER *prov,
const OSSL_PARAM params[])
{
const OSSL_PARAM *p;
p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_NAME);
if (p != NULL && !OSSL_PARAM_set_utf8_ptr(p, "OpenSSL FIPS Provider"))
return 0;
p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_VERSION);
if (p != NULL && !OSSL_PARAM_set_utf8_ptr(p, OPENSSL_VERSION_STR))
return 0;
p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_BUILDINFO);
if (p != NULL && !OSSL_PARAM_set_utf8_ptr(p, OPENSSL_FULL_VERSION_STR))
return 0;
return 1;
}
extern const OSSL_DISPATCH sha256_functions[];
static const OSSL_ALGORITHM fips_digests[] = {
{ "SHA256", "fips=yes", sha256_functions },
{ NULL, NULL, NULL }
};
static const OSSL_ALGORITHM *fips_query(OSSL_PROVIDER *prov,
int operation_id,
int *no_cache)
{
*no_cache = 0;
switch (operation_id) {
case OSSL_OP_DIGEST:
return fips_digests;
}
return NULL;
}
/* Functions we provide to the core */
static const OSSL_DISPATCH fips_dispatch_table[] = {
/*
* To release our resources we just need to free the OPENSSL_CTX so we just
* use OPENSSL_CTX_free directly as our teardown function
*/
{ OSSL_FUNC_PROVIDER_TEARDOWN, (void (*)(void))OPENSSL_CTX_free },
{ OSSL_FUNC_PROVIDER_GET_PARAM_TYPES, (void (*)(void))fips_get_param_types },
{ OSSL_FUNC_PROVIDER_GET_PARAMS, (void (*)(void))fips_get_params },
{ OSSL_FUNC_PROVIDER_QUERY_OPERATION, (void (*)(void))fips_query },
{ 0, NULL }
};
/* Functions we provide to ourself */
static const OSSL_DISPATCH intern_dispatch_table[] = {
{ OSSL_FUNC_PROVIDER_QUERY_OPERATION, (void (*)(void))fips_query },
{ 0, NULL }
};
int OSSL_provider_init(const OSSL_PROVIDER *provider,
const OSSL_DISPATCH *in,
const OSSL_DISPATCH **out,
void **provctx)
{
OPENSSL_CTX *ctx;
for (; in->function_id != 0; in++) {
switch (in->function_id) {
case OSSL_FUNC_CORE_GET_PARAM_TYPES:
c_get_param_types = OSSL_get_core_get_param_types(in);
break;
case OSSL_FUNC_CORE_GET_PARAMS:
c_get_params = OSSL_get_core_get_params(in);
break;
case OSSL_FUNC_CORE_PUT_ERROR:
c_put_error = OSSL_get_core_put_error(in);
break;
case OSSL_FUNC_CORE_ADD_ERROR_VDATA:
c_add_error_vdata = OSSL_get_core_add_error_vdata(in);
break;
/* Just ignore anything we don't understand */
default:
break;
}
}
ctx = OPENSSL_CTX_new();
if (ctx == NULL)
return 0;
/*
* TODO(3.0): Remove me. This is just a dummy call to demonstrate making
* EVP calls from within the FIPS module.
*/
if (!dummy_evp_call(ctx)) {
OPENSSL_CTX_free(ctx);
return 0;
}
*out = fips_dispatch_table;
*provctx = ctx;
return 1;
}
/*
* The internal init function used when the FIPS module uses EVP to call
* another algorithm also in the FIPS module.
*/
OSSL_provider_init_fn fips_intern_provider_init;
int fips_intern_provider_init(const OSSL_PROVIDER *provider,
const OSSL_DISPATCH *in,
const OSSL_DISPATCH **out,
void **provctx)
{
*out = intern_dispatch_table;
return 1;
}
void ERR_put_error(int lib, int func, int reason, const char *file, int line)
{
/*
* TODO(3.0): This works for the FIPS module because we're going to be
* using lib/func/reason codes that libcrypto already knows about. This
* won't work for third party providers that have their own error mechanisms,
* so we'll need to come up with something else for them.
*/
c_put_error(lib, func, reason, file, line);
}
void ERR_add_error_data(int num, ...)
{
va_list args;
va_start(args, num);
ERR_add_error_vdata(num, args);
va_end(args);
}
void ERR_add_error_vdata(int num, va_list args)
{
c_add_error_vdata(num, args);
}
|
