Compare commits
No commits in common. "imports/c9/gnutls-3.7.6-21.el9_2" and "c8" have entirely different histories.
imports/c9
...
c8
|
@ -1,4 +1,3 @@
|
|||
SOURCES/gmp-6.2.1.tar.xz
|
||||
SOURCES/gnutls-3.7.6.tar.xz
|
||||
SOURCES/gnutls-3.7.6.tar.xz.sig
|
||||
SOURCES/gnutls-release-keyring.gpg
|
||||
SOURCES/gnutls-3.6.16.tar.xz
|
||||
SOURCES/gnutls-3.6.16.tar.xz.sig
|
||||
SOURCES/gpgkey-462225C3B46F34879FC8496CD605848ED7E69871.gpg
|
||||
|
|
|
@ -1,4 +1,3 @@
|
|||
0578d48607ec0e272177d175fd1807c30b00fdf2 SOURCES/gmp-6.2.1.tar.xz
|
||||
47591374259451fe2cd86c5fe7c345e769a6c79b SOURCES/gnutls-3.7.6.tar.xz
|
||||
0ebda3673eafa2ab34068a7ea798d6e385440d56 SOURCES/gnutls-3.7.6.tar.xz.sig
|
||||
befcf25b9dcd1d36b8bdb754c80c639eca45baa0 SOURCES/gnutls-release-keyring.gpg
|
||||
6ba8fb898dcf4b4046b60662ba97df835593e687 SOURCES/gnutls-3.6.16.tar.xz
|
||||
b41ac56ff6cca4539c8b084db2c84e8bc21d60ac SOURCES/gnutls-3.6.16.tar.xz.sig
|
||||
648ec46f9539fe756fb90131b85ae4759ed2ed21 SOURCES/gpgkey-462225C3B46F34879FC8496CD605848ED7E69871.gpg
|
||||
|
|
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
|
@ -0,0 +1,204 @@
|
|||
From f09b7627a63defb1c55e9965fb05e0bbddb90247 Mon Sep 17 00:00:00 2001
|
||||
From: Daiki Ueno <ueno@gnu.org>
|
||||
Date: Tue, 6 Oct 2020 11:54:21 +0200
|
||||
Subject: [PATCH] fips: use larger prime for DH self-tests
|
||||
|
||||
According to FIPS140-2 IG 7.5, the minimum key size of FFC through
|
||||
2030 is defined as 2048 bits. This updates the relevant self-test
|
||||
using ffdhe3072 defined in RFC 7919.
|
||||
|
||||
Signed-off-by: Daiki Ueno <ueno@gnu.org>
|
||||
---
|
||||
lib/crypto-selftests-pk.c | 142 ++++++++++++++++++++++++++++++++++----
|
||||
lib/dh-primes.c | 4 --
|
||||
2 files changed, 130 insertions(+), 16 deletions(-)
|
||||
|
||||
diff --git a/lib/crypto-selftests-pk.c b/lib/crypto-selftests-pk.c
|
||||
index 70b0f618f..9b7c692a8 100644
|
||||
--- a/lib/crypto-selftests-pk.c
|
||||
+++ b/lib/crypto-selftests-pk.c
|
||||
@@ -620,32 +620,150 @@ static int test_dh(void)
|
||||
gnutls_pk_params_st priv;
|
||||
gnutls_pk_params_st pub;
|
||||
gnutls_datum_t out = {NULL, 0};
|
||||
+
|
||||
+ /* FFDHE 3072 test vector provided by Stephan Mueller in:
|
||||
+ * https://gitlab.com/gnutls/gnutls/-/merge_requests/1342#note_424430996
|
||||
+ */
|
||||
static const uint8_t known_dh_k[] = {
|
||||
- 0x10, 0x25, 0x04, 0xb5, 0xc6, 0xc2, 0xcb,
|
||||
- 0x0c, 0xe9, 0xc5, 0x58, 0x0d, 0x22, 0x62};
|
||||
- static const uint8_t test_p[] = {
|
||||
- 0x24, 0x85, 0xdd, 0x3a, 0x74, 0x42, 0xe4,
|
||||
- 0xb3, 0xf1, 0x0b, 0x13, 0xf9, 0x17, 0x4d };
|
||||
- static const uint8_t test_g[] = { 0x02 };
|
||||
+ 0xec, 0xb3, 0x85, 0x0c, 0x72, 0x55, 0x55, 0xc2, 0x98, 0x36,
|
||||
+ 0xbe, 0x75, 0x9e, 0xc9, 0x9d, 0x8b, 0x16, 0xa6, 0xe6, 0x84,
|
||||
+ 0x33, 0x12, 0x80, 0x1d, 0xac, 0xde, 0x6a, 0xd7, 0x3b, 0x1e,
|
||||
+ 0x15, 0xca, 0x5d, 0x26, 0xb3, 0x0a, 0x35, 0xf4, 0xbb, 0xad,
|
||||
+ 0x71, 0xcb, 0x03, 0x1a, 0xcb, 0xfb, 0x83, 0xf0, 0xa8, 0xde,
|
||||
+ 0xed, 0x5e, 0x3d, 0x98, 0xd2, 0xb0, 0xef, 0xad, 0xdf, 0x32,
|
||||
+ 0xa0, 0x16, 0x7d, 0x0e, 0x29, 0xd8, 0x85, 0xca, 0x12, 0x97,
|
||||
+ 0x56, 0xab, 0x6a, 0x26, 0xa4, 0x46, 0x3d, 0x87, 0xd7, 0xe0,
|
||||
+ 0xb4, 0x3e, 0x28, 0x75, 0xac, 0x59, 0xc5, 0x71, 0x3a, 0x24,
|
||||
+ 0x15, 0x76, 0x98, 0x72, 0x94, 0x2d, 0xd0, 0x0e, 0xbc, 0x9a,
|
||||
+ 0x77, 0xd4, 0xe2, 0xb2, 0x76, 0x54, 0x4a, 0x56, 0xbe, 0x0b,
|
||||
+ 0x43, 0xf8, 0x21, 0x6f, 0x54, 0x32, 0xde, 0xb7, 0xd5, 0xb7,
|
||||
+ 0x08, 0x00, 0xd2, 0x57, 0x8c, 0x0b, 0x8b, 0x02, 0x3e, 0xdb,
|
||||
+ 0x72, 0x54, 0x3a, 0xc0, 0x50, 0x66, 0xbc, 0xc9, 0x67, 0xf5,
|
||||
+ 0x22, 0x28, 0xf2, 0x3c, 0x51, 0x94, 0x61, 0x26, 0x9a, 0xc6,
|
||||
+ 0x42, 0x0e, 0x8b, 0x42, 0xad, 0x79, 0x40, 0xa9, 0x0b, 0xdc,
|
||||
+ 0x84, 0xd5, 0x71, 0x83, 0x94, 0xd9, 0x83, 0x2f, 0x08, 0x74,
|
||||
+ 0xbc, 0x37, 0x6a, 0x3e, 0x1e, 0xbc, 0xcc, 0x09, 0x23, 0x30,
|
||||
+ 0x79, 0x01, 0x39, 0xf6, 0xe3, 0xa8, 0xc0, 0xfa, 0x7e, 0xdb,
|
||||
+ 0x0b, 0x71, 0x3e, 0x4f, 0x1f, 0x69, 0x84, 0xa6, 0x58, 0x6c,
|
||||
+ 0x36, 0x2c, 0xcc, 0xb4, 0x7c, 0x94, 0xec, 0x06, 0x0b, 0x11,
|
||||
+ 0x53, 0x95, 0xe6, 0x05, 0x43, 0xa4, 0xe4, 0xea, 0x1d, 0x4f,
|
||||
+ 0xdc, 0xd0, 0x38, 0x0e, 0x32, 0xa1, 0xde, 0xd9, 0x8d, 0xd8,
|
||||
+ 0x20, 0xac, 0x04, 0x83, 0xf8, 0x1b, 0x55, 0x52, 0x16, 0x20,
|
||||
+ 0xe3, 0x2e, 0x6d, 0x11, 0x15, 0x29, 0x2f, 0x3a, 0x7c, 0x80,
|
||||
+ 0x0a, 0x71, 0x3d, 0x31, 0x9c, 0x1b, 0x73, 0x59, 0xe1, 0x0d,
|
||||
+ 0x27, 0xc5, 0xc0, 0x6a, 0x72, 0x3a, 0x5b, 0xd6, 0xf6, 0x50,
|
||||
+ 0xe6, 0x69, 0x48, 0x1e, 0xfd, 0xeb, 0x4a, 0x47, 0x73, 0xfb,
|
||||
+ 0x88, 0x14, 0xea, 0x6d, 0x36, 0xe1, 0x4c, 0x2c, 0xf9, 0x04,
|
||||
+ 0xc1, 0xb7, 0x29, 0xfc, 0x5d, 0x02, 0x5d, 0x1c, 0x4d, 0x31,
|
||||
+ 0x4a, 0x51, 0x3f, 0xa4, 0x45, 0x19, 0x29, 0xc4, 0x32, 0xa6,
|
||||
+ 0x45, 0xdb, 0x94, 0x3a, 0xbd, 0x76, 0x2c, 0xd6, 0x1a, 0xb1,
|
||||
+ 0xff, 0xe7, 0x62, 0x75, 0x16, 0xe5, 0x0b, 0xa3, 0x3a, 0x93,
|
||||
+ 0x84, 0xd6, 0xad, 0xc2, 0x24, 0x68, 0x3d, 0xd6, 0x07, 0xe4,
|
||||
+ 0xbe, 0x5a, 0x49, 0x31, 0x06, 0xad, 0x3f, 0x31, 0x4a, 0x1c,
|
||||
+ 0xf7, 0x58, 0xdf, 0x34, 0xcb, 0xc8, 0xa9, 0x07, 0x24, 0x42,
|
||||
+ 0x63, 0xa5, 0x8e, 0xdd, 0x37, 0x78, 0x92, 0x68, 0x3f, 0xd8,
|
||||
+ 0x2f, 0xea, 0x8c, 0xf1, 0x8e, 0xd4, 0x8b, 0xa7, 0x3f, 0xa0,
|
||||
+ 0xfa, 0xaf, 0xf0, 0x35,
|
||||
+ };
|
||||
static const uint8_t test_x[] = {
|
||||
- 0x06, 0x2c, 0x96, 0xae, 0x0e, 0x9e, 0x9b,
|
||||
- 0xbb, 0x41, 0x51, 0x7a, 0xa7, 0xc5, 0xfe };
|
||||
+ 0x16, 0x5c, 0xa6, 0xe0, 0x9b, 0x87, 0xfa, 0x2d, 0xbc, 0x13,
|
||||
+ 0x20, 0xcd, 0xac, 0x4e, 0xcc, 0x60, 0x1e, 0x48, 0xec, 0xbe,
|
||||
+ 0x73, 0x0c, 0xa8, 0x6b, 0x6e, 0x2a, 0xee, 0xdd, 0xd8, 0xf3,
|
||||
+ 0x2d, 0x5f, 0x75, 0xf3, 0x07, 0x94, 0x88, 0x3d, 0xb1, 0x38,
|
||||
+ 0xcf, 0xae, 0x4a, 0xcc, 0xcb, 0x6a, 0x80, 0xbc, 0xeb, 0x3b,
|
||||
+ 0xaa, 0x0b, 0x18, 0x74, 0x58, 0x7c, 0x3e, 0x74, 0xef, 0xb6,
|
||||
+ 0xd3, 0x15, 0xee, 0x73, 0x29, 0x88, 0x7b, 0x65, 0x02, 0x39,
|
||||
+ 0x33, 0xec, 0x22, 0x06, 0x8c, 0x5b, 0xd6, 0x2f, 0x4c, 0xf7,
|
||||
+ 0xe0, 0x97, 0x6d, 0x2a, 0x90, 0x36, 0xfe, 0x1a, 0x44, 0x4d,
|
||||
+ 0x9d, 0x41, 0x4b, 0xcb, 0xec, 0x25, 0xf4, 0xc3, 0xa5, 0x91,
|
||||
+ 0xd0, 0x90, 0xc9, 0x34, 0x7b, 0xba, 0x27, 0x30, 0x5a, 0xa2,
|
||||
+ 0x21, 0x58, 0xce, 0x88, 0x25, 0x39, 0xaf, 0xf1, 0x17, 0x02,
|
||||
+ 0x12, 0xf8, 0x55, 0xdc, 0xd2, 0x08, 0x5b, 0xd3, 0xc7, 0x8e,
|
||||
+ 0xcf, 0x29, 0x85, 0x85, 0xdb, 0x5c, 0x08, 0xc2, 0xd7, 0xb0,
|
||||
+ 0x33, 0x0e, 0xe3, 0xb9, 0x2c, 0x1a, 0x1d, 0x4b, 0xe5, 0x76,
|
||||
+ 0x8f, 0xd3, 0x14, 0xb6, 0x8c, 0xdc, 0x9a, 0xe8, 0x15, 0x60,
|
||||
+ 0x60, 0x5e, 0xaa, 0xf9, 0xfa, 0xa6, 0xb2, 0x4f, 0xff, 0x46,
|
||||
+ 0xc1, 0x5e, 0x93, 0x50, 0x90, 0x7e, 0x4c, 0x26, 0xd7, 0xbb,
|
||||
+ 0x21, 0x05, 0x3d, 0x27, 0xc5, 0x9b, 0x0d, 0x46, 0x69, 0xe4,
|
||||
+ 0x74, 0x87, 0x74, 0x55, 0xee, 0x5f, 0xe5, 0x72, 0x04, 0x46,
|
||||
+ 0x1f, 0x2e, 0x55, 0xc7, 0xcc, 0x2b, 0x2b, 0x39, 0x6d, 0x90,
|
||||
+ 0x60, 0x31, 0x37, 0x5b, 0x44, 0xde, 0xfd, 0xf2, 0xd1, 0xc6,
|
||||
+ 0x9c, 0x12, 0x82, 0xcc, 0x7c, 0xb1, 0x0e, 0xa9, 0x95, 0x9d,
|
||||
+ 0xe0, 0xa8, 0x3e, 0xc1, 0xa3, 0x4a, 0x6a, 0x37, 0x59, 0x17,
|
||||
+ 0x93, 0x63, 0x1e, 0xbf, 0x04, 0xa3, 0xaa, 0xc0, 0x1d, 0xc4,
|
||||
+ 0x6d, 0x7a, 0xdc, 0x69, 0x9c, 0xb0, 0x22, 0x56, 0xd9, 0x76,
|
||||
+ 0x92, 0x2d, 0x1e, 0x62, 0xae, 0xfd, 0xd6, 0x9b, 0xfd, 0x08,
|
||||
+ 0x2c, 0x95, 0xec, 0xe7, 0x02, 0x43, 0x62, 0x68, 0x1a, 0xaf,
|
||||
+ 0x46, 0x59, 0xb7, 0xce, 0x8e, 0x42, 0x24, 0xae, 0xf7, 0x0e,
|
||||
+ 0x9a, 0x3b, 0xf8, 0x77, 0xdf, 0x26, 0x85, 0x9f, 0x45, 0xad,
|
||||
+ 0x8c, 0xa9, 0x54, 0x9c, 0x46, 0x44, 0xd5, 0x8a, 0xe9, 0xcc,
|
||||
+ 0x34, 0x5e, 0xc5, 0xd1, 0x42, 0x6f, 0x44, 0xf3, 0x0f, 0x90,
|
||||
+ 0x3a, 0x32, 0x1a, 0x9c, 0x2a, 0x63, 0xec, 0x21, 0xb4, 0xfc,
|
||||
+ 0xfa, 0xa5, 0xcf, 0xe7, 0x9e, 0x43, 0xc7, 0x49, 0x56, 0xbc,
|
||||
+ 0x50, 0xc5, 0x84, 0xf0, 0x42, 0xc8, 0x6a, 0xf1, 0x78, 0xe4,
|
||||
+ 0xaa, 0x06, 0x37, 0xe1, 0x30, 0xf7, 0x65, 0x97, 0xca, 0xfd,
|
||||
+ 0x35, 0xfa, 0xeb, 0x48, 0x6d, 0xaa, 0x45, 0x46, 0x9d, 0xbc,
|
||||
+ 0x1d, 0x98, 0x17, 0x45, 0xa3, 0xee, 0x21, 0xa0, 0x97, 0x38,
|
||||
+ 0x80, 0xc5, 0x28, 0x1f,
|
||||
+ };
|
||||
static const uint8_t test_y[] = { /* y=g^x mod p */
|
||||
- 0x1e, 0xca, 0x23, 0x2a, 0xfd, 0x34, 0xe1,
|
||||
- 0x10, 0x7a, 0xff, 0xaf, 0x2d, 0xaa, 0x53 };
|
||||
+ 0x93, 0xeb, 0x5c, 0x37, 0x1d, 0x3c, 0x06, 0x6f, 0xbf, 0xbe,
|
||||
+ 0x96, 0x51, 0x26, 0x58, 0x81, 0x36, 0xc6, 0x4f, 0x9a, 0x34,
|
||||
+ 0xc4, 0xc5, 0xa8, 0xa3, 0x2c, 0x41, 0x76, 0xa8, 0xc6, 0xc0,
|
||||
+ 0xa0, 0xc8, 0x51, 0x36, 0xc4, 0x40, 0x4e, 0x2c, 0x69, 0xf7,
|
||||
+ 0x51, 0xbb, 0xb0, 0xd6, 0xf5, 0xdb, 0x40, 0x29, 0x50, 0x3b,
|
||||
+ 0x8a, 0xf9, 0xf3, 0x53, 0x78, 0xfc, 0x86, 0xe9, 0xf1, 0xe9,
|
||||
+ 0xac, 0x85, 0x13, 0x65, 0x62, 0x22, 0x04, 0x1b, 0x14, 0x2a,
|
||||
+ 0xf4, 0x8f, 0x2f, 0xf1, 0x2f, 0x81, 0xd6, 0x18, 0x0e, 0x76,
|
||||
+ 0x91, 0x43, 0xb2, 0xfc, 0x7c, 0x6f, 0x0c, 0x45, 0x37, 0x31,
|
||||
+ 0x31, 0x58, 0x5c, 0xdf, 0x42, 0x24, 0x7a, 0xba, 0x8b, 0x7f,
|
||||
+ 0x79, 0x06, 0x07, 0xef, 0xd6, 0x06, 0xeb, 0xcb, 0x3c, 0xbd,
|
||||
+ 0xbc, 0xe5, 0xff, 0xfd, 0x62, 0x15, 0x0c, 0x40, 0x46, 0x37,
|
||||
+ 0xef, 0xd0, 0xa1, 0xde, 0x63, 0x4f, 0x20, 0x0b, 0x45, 0x7d,
|
||||
+ 0x06, 0x77, 0xfd, 0x23, 0xc1, 0x32, 0x8a, 0x89, 0x65, 0x16,
|
||||
+ 0xe8, 0x48, 0x12, 0x1c, 0x25, 0x33, 0x2d, 0xbd, 0xd8, 0x9f,
|
||||
+ 0x1c, 0x9d, 0xbc, 0xe3, 0x08, 0x60, 0x87, 0x1a, 0xc6, 0x06,
|
||||
+ 0x36, 0xd2, 0xac, 0x09, 0x6d, 0x99, 0x02, 0x89, 0xc6, 0x12,
|
||||
+ 0x93, 0x8c, 0x4b, 0xd0, 0x7e, 0x36, 0x8a, 0xd6, 0xa0, 0x97,
|
||||
+ 0x4f, 0x97, 0x3f, 0x97, 0x0b, 0xfe, 0x05, 0xfc, 0xc8, 0xef,
|
||||
+ 0x21, 0x4d, 0x4a, 0x06, 0x6e, 0xb4, 0xa6, 0x4f, 0xe1, 0xdd,
|
||||
+ 0x44, 0x06, 0xfa, 0xd5, 0x0e, 0x54, 0xf5, 0x54, 0x3e, 0x8c,
|
||||
+ 0xb9, 0x85, 0x86, 0x00, 0x40, 0x98, 0xe7, 0x01, 0xdd, 0x93,
|
||||
+ 0x9d, 0x95, 0xea, 0xf0, 0xd3, 0x99, 0x4b, 0xeb, 0xd5, 0x79,
|
||||
+ 0x47, 0xa4, 0xad, 0x2a, 0xe0, 0x4d, 0x36, 0x3b, 0x46, 0x10,
|
||||
+ 0x96, 0xbb, 0x48, 0xe9, 0xa1, 0x78, 0x01, 0x35, 0x0a, 0x5c,
|
||||
+ 0x7b, 0x3f, 0xf5, 0xf7, 0xb1, 0xe3, 0x97, 0x17, 0x4d, 0x76,
|
||||
+ 0x10, 0x8d, 0x68, 0x4c, 0x94, 0x7d, 0xee, 0x0e, 0x20, 0x8b,
|
||||
+ 0xce, 0x7d, 0x0a, 0xa3, 0x51, 0xfb, 0xe6, 0xcf, 0xf0, 0x0e,
|
||||
+ 0x7f, 0x3c, 0xd4, 0xef, 0x56, 0x31, 0xb2, 0x95, 0xf0, 0x5f,
|
||||
+ 0x4b, 0x9c, 0x03, 0x9e, 0xae, 0xb1, 0xc1, 0x46, 0xd7, 0xc0,
|
||||
+ 0x4f, 0xb0, 0xf6, 0x6c, 0xe1, 0xe9, 0x2a, 0x97, 0xe0, 0x3f,
|
||||
+ 0x3a, 0x93, 0x04, 0xcd, 0x41, 0x7d, 0x45, 0x03, 0xb3, 0x40,
|
||||
+ 0x20, 0xe6, 0xad, 0x2d, 0xd3, 0xf7, 0x32, 0x7b, 0xcc, 0x4f,
|
||||
+ 0x81, 0x18, 0x4c, 0x50, 0x77, 0xc4, 0xb7, 0x6a, 0x4d, 0x05,
|
||||
+ 0xd8, 0x6d, 0xbf, 0x6f, 0xba, 0x1d, 0x38, 0x78, 0x87, 0xd2,
|
||||
+ 0x8e, 0xc2, 0x6d, 0xb6, 0xed, 0x66, 0x61, 0xa8, 0xb9, 0x19,
|
||||
+ 0x0e, 0x93, 0xd1, 0xcd, 0x5b, 0xbe, 0x19, 0x05, 0x52, 0x43,
|
||||
+ 0xd6, 0xc1, 0x07, 0x3c, 0x6a, 0x62, 0xbd, 0x33, 0x9b, 0x1b,
|
||||
+ 0x02, 0x42, 0x61, 0x14,
|
||||
+ };
|
||||
|
||||
gnutls_pk_params_init(&priv);
|
||||
gnutls_pk_params_init(&pub);
|
||||
|
||||
priv.algo = pub.algo = GNUTLS_PK_DH;
|
||||
|
||||
- ret = _gnutls_mpi_init_scan(&priv.params[DH_P], test_p, sizeof(test_p));
|
||||
+ ret = _gnutls_mpi_init_scan(&priv.params[DH_P],
|
||||
+ gnutls_ffdhe_3072_group_prime.data,
|
||||
+ gnutls_ffdhe_3072_group_prime.size);
|
||||
if (ret < 0) {
|
||||
gnutls_assert();
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
- ret = _gnutls_mpi_init_scan(&priv.params[DH_G], test_g, sizeof(test_g));
|
||||
+ ret = _gnutls_mpi_init_scan(&priv.params[DH_G],
|
||||
+ gnutls_ffdhe_3072_group_generator.data,
|
||||
+ gnutls_ffdhe_3072_group_generator.size);
|
||||
if (ret < 0) {
|
||||
gnutls_assert();
|
||||
goto cleanup;
|
||||
diff --git a/lib/dh-primes.c b/lib/dh-primes.c
|
||||
index a440b5b98..94b69e345 100644
|
||||
--- a/lib/dh-primes.c
|
||||
+++ b/lib/dh-primes.c
|
||||
@@ -23,8 +23,6 @@
|
||||
#include "gnutls_int.h"
|
||||
#include <gnutls/gnutls.h>
|
||||
|
||||
-#if defined(ENABLE_DHE) || defined(ENABLE_ANON)
|
||||
-
|
||||
#include "dh.h"
|
||||
|
||||
static const unsigned char ffdhe_generator = 0x02;
|
||||
@@ -1934,5 +1932,3 @@ _gnutls_dh_prime_match_fips_approved(const uint8_t *prime,
|
||||
|
||||
return 0;
|
||||
}
|
||||
-
|
||||
-#endif
|
||||
--
|
||||
2.26.2
|
||||
|
|
@ -0,0 +1,713 @@
|
|||
From 93c0e3ba4d2cfee86b32f28f33303a2193c4133c Mon Sep 17 00:00:00 2001
|
||||
From: Daiki Ueno <ueno@gnu.org>
|
||||
Date: Mon, 5 Oct 2020 16:12:46 +0200
|
||||
Subject: [PATCH 1/4] fips: add self-tests for HKDF
|
||||
|
||||
FIPS140-2 IG D.8 mandates self-test on approved KDF algorithms. As
|
||||
the guidance only requires running a single instance of each KDF
|
||||
mechanism, this only exercises HKDF-Extract and HKDF-Expand operations
|
||||
with HMAC-SHA-256 as the underlying MAC.
|
||||
|
||||
Although HKDF is non-approved, it would be sensible to do that as it
|
||||
will be approved in FIPS140-3.
|
||||
|
||||
Signed-off-by: Daiki Ueno <ueno@gnu.org>
|
||||
---
|
||||
devel/libgnutls-latest-x86_64.abi | 1 +
|
||||
lib/crypto-selftests.c | 159 ++++++++++++++++++++++++++++++
|
||||
lib/fips.c | 7 ++
|
||||
lib/includes/gnutls/self-test.h | 1 +
|
||||
lib/libgnutls.map | 1 +
|
||||
5 files changed, 169 insertions(+)
|
||||
|
||||
diff --git a/lib/crypto-selftests.c b/lib/crypto-selftests.c
|
||||
index 7a1c7729c..bd148b6af 100644
|
||||
--- a/lib/crypto-selftests.c
|
||||
+++ b/lib/crypto-selftests.c
|
||||
@@ -2917,3 +2917,162 @@ int gnutls_digest_self_test(unsigned flags, gnutls_digest_algorithm_t digest)
|
||||
|
||||
return 0;
|
||||
}
|
||||
+
|
||||
+struct hkdf_vectors_st {
|
||||
+ const uint8_t *ikm;
|
||||
+ unsigned int ikm_size;
|
||||
+ const uint8_t *salt;
|
||||
+ unsigned int salt_size;
|
||||
+ const uint8_t *prk;
|
||||
+ unsigned int prk_size;
|
||||
+ const uint8_t *info;
|
||||
+ unsigned int info_size;
|
||||
+ const uint8_t *okm;
|
||||
+ unsigned int okm_size;
|
||||
+};
|
||||
+
|
||||
+const struct hkdf_vectors_st hkdf_sha256_vectors[] = {
|
||||
+ /* RFC 5869: A.1. Test Case 1: Basic test case with SHA-256 */
|
||||
+ {
|
||||
+ STR(ikm, ikm_size,
|
||||
+ "\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b"
|
||||
+ "\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b"),
|
||||
+ STR(salt, salt_size,
|
||||
+ "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c"),
|
||||
+ STR(prk, prk_size,
|
||||
+ "\x07\x77\x09\x36\x2c\x2e\x32\xdf\x0d\xdc\x3f\x0d\xc4\x7b"
|
||||
+ "\xba\x63\x90\xb6\xc7\x3b\xb5\x0f\x9c\x31\x22\xec\x84\x4a"
|
||||
+ "\xd7\xc2\xb3\xe5"),
|
||||
+ STR(info, info_size,
|
||||
+ "\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9"),
|
||||
+ STR(okm, okm_size,
|
||||
+ "\x3c\xb2\x5f\x25\xfa\xac\xd5\x7a\x90\x43\x4f\x64\xd0\x36"
|
||||
+ "\x2f\x2a\x2d\x2d\x0a\x90\xcf\x1a\x5a\x4c\x5d\xb0\x2d\x56"
|
||||
+ "\xec\xc4\xc5\xbf\x34\x00\x72\x08\xd5\xb8\x87\x18\x58\x65"),
|
||||
+ },
|
||||
+ /* RFC 5869: A.2. Test Case 2: Test with SHA-256 and longer inputs/outputs */
|
||||
+ {
|
||||
+ STR(ikm, ikm_size,
|
||||
+ "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d"
|
||||
+ "\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b"
|
||||
+ "\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29"
|
||||
+ "\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37"
|
||||
+ "\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45"
|
||||
+ "\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f"),
|
||||
+ STR(salt, salt_size,
|
||||
+ "\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d"
|
||||
+ "\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b"
|
||||
+ "\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89"
|
||||
+ "\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97"
|
||||
+ "\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5"
|
||||
+ "\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf"),
|
||||
+ STR(prk, prk_size,
|
||||
+ "\x06\xa6\xb8\x8c\x58\x53\x36\x1a\x06\x10\x4c\x9c\xeb\x35"
|
||||
+ "\xb4\x5c\xef\x76\x00\x14\x90\x46\x71\x01\x4a\x19\x3f\x40"
|
||||
+ "\xc1\x5f\xc2\x44"),
|
||||
+ STR(info, info_size,
|
||||
+ "\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd"
|
||||
+ "\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb"
|
||||
+ "\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9"
|
||||
+ "\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7"
|
||||
+ "\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5"
|
||||
+ "\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"),
|
||||
+ STR(okm, okm_size,
|
||||
+ "\xb1\x1e\x39\x8d\xc8\x03\x27\xa1\xc8\xe7\xf7\x8c\x59\x6a"
|
||||
+ "\x49\x34\x4f\x01\x2e\xda\x2d\x4e\xfa\xd8\xa0\x50\xcc\x4c"
|
||||
+ "\x19\xaf\xa9\x7c\x59\x04\x5a\x99\xca\xc7\x82\x72\x71\xcb"
|
||||
+ "\x41\xc6\x5e\x59\x0e\x09\xda\x32\x75\x60\x0c\x2f\x09\xb8"
|
||||
+ "\x36\x77\x93\xa9\xac\xa3\xdb\x71\xcc\x30\xc5\x81\x79\xec"
|
||||
+ "\x3e\x87\xc1\x4c\x01\xd5\xc1\xf3\x43\x4f\x1d\x87"),
|
||||
+ },
|
||||
+};
|
||||
+
|
||||
+static int test_hkdf(gnutls_mac_algorithm_t mac,
|
||||
+ const struct hkdf_vectors_st *vectors,
|
||||
+ size_t vectors_size, unsigned flags)
|
||||
+{
|
||||
+ unsigned int i;
|
||||
+
|
||||
+ for (i = 0; i < vectors_size; i++) {
|
||||
+ gnutls_datum_t ikm, prk, salt, info;
|
||||
+ uint8_t output[4096];
|
||||
+ int ret;
|
||||
+
|
||||
+ ikm.data = (void *) vectors[i].ikm;
|
||||
+ ikm.size = vectors[i].ikm_size;
|
||||
+ salt.data = (void *) vectors[i].salt;
|
||||
+ salt.size = vectors[i].salt_size;
|
||||
+
|
||||
+ ret = gnutls_hkdf_extract(mac, &ikm, &salt, output);
|
||||
+ if (ret < 0) {
|
||||
+ _gnutls_debug_log("error extracting HKDF: MAC-%s\n",
|
||||
+ gnutls_mac_get_name(mac));
|
||||
+ return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
+ }
|
||||
+
|
||||
+ if (memcmp(output, vectors[i].prk, vectors[i].prk_size) != 0) {
|
||||
+ _gnutls_debug_log
|
||||
+ ("HKDF extract: MAC-%s test vector failed!\n",
|
||||
+ gnutls_mac_get_name(mac));
|
||||
+
|
||||
+ return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
+ }
|
||||
+
|
||||
+ prk.data = (void *) vectors[i].prk;
|
||||
+ prk.size = vectors[i].prk_size;
|
||||
+ info.data = (void *) vectors[i].info;
|
||||
+ info.size = vectors[i].info_size;
|
||||
+
|
||||
+ ret = gnutls_hkdf_expand(mac, &prk, &info,
|
||||
+ output, vectors[i].okm_size);
|
||||
+ if (ret < 0) {
|
||||
+ _gnutls_debug_log("error extracting HKDF: MAC-%s\n",
|
||||
+ gnutls_mac_get_name(mac));
|
||||
+ return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
+ }
|
||||
+
|
||||
+ if (memcmp(output, vectors[i].okm, vectors[i].okm_size) != 0) {
|
||||
+ _gnutls_debug_log
|
||||
+ ("HKDF expand: MAC-%s test vector failed!\n",
|
||||
+ gnutls_mac_get_name(mac));
|
||||
+
|
||||
+ return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ _gnutls_debug_log
|
||||
+ ("HKDF: MAC-%s self check succeeded\n",
|
||||
+ gnutls_mac_get_name(mac));
|
||||
+
|
||||
+ return 0;
|
||||
+}
|
||||
+
|
||||
+/*-
|
||||
+ * gnutls_hkdf_self_test:
|
||||
+ * @flags: GNUTLS_SELF_TEST_FLAG flags
|
||||
+ * @mac: the message authentication algorithm to use
|
||||
+ *
|
||||
+ * This function will run self tests on HKDF with the provided mac.
|
||||
+ *
|
||||
+ * Returns: Zero or a negative error code on error.
|
||||
+ *
|
||||
+ * Since: 3.3.0-FIPS140
|
||||
+ -*/
|
||||
+int gnutls_hkdf_self_test(unsigned flags, gnutls_mac_algorithm_t mac)
|
||||
+{
|
||||
+ int ret;
|
||||
+
|
||||
+ if (flags & GNUTLS_SELF_TEST_FLAG_ALL)
|
||||
+ mac = GNUTLS_MAC_UNKNOWN;
|
||||
+
|
||||
+ switch (mac) {
|
||||
+ case GNUTLS_MAC_UNKNOWN:
|
||||
+ CASE(GNUTLS_MAC_SHA256, test_hkdf, hkdf_sha256_vectors);
|
||||
+
|
||||
+ break;
|
||||
+ default:
|
||||
+ return gnutls_assert_val(GNUTLS_E_NO_SELF_TEST);
|
||||
+ }
|
||||
+
|
||||
+ return 0;
|
||||
+}
|
||||
diff --git a/lib/fips.c b/lib/fips.c
|
||||
index f8b10f750..48891ed57 100644
|
||||
--- a/lib/fips.c
|
||||
+++ b/lib/fips.c
|
||||
@@ -423,6 +423,13 @@ int _gnutls_fips_perform_self_checks2(void)
|
||||
goto error;
|
||||
}
|
||||
|
||||
+ /* HKDF */
|
||||
+ ret = gnutls_hkdf_self_test(0, GNUTLS_MAC_SHA256);
|
||||
+ if (ret < 0) {
|
||||
+ gnutls_assert();
|
||||
+ goto error;
|
||||
+ }
|
||||
+
|
||||
if (_gnutls_rnd_ops.self_test == NULL) {
|
||||
gnutls_assert();
|
||||
goto error;
|
||||
diff --git a/lib/includes/gnutls/self-test.h b/lib/includes/gnutls/self-test.h
|
||||
index aacbe94ca..9b7be8159 100644
|
||||
--- a/lib/includes/gnutls/self-test.h
|
||||
+++ b/lib/includes/gnutls/self-test.h
|
||||
@@ -34,5 +34,6 @@ int gnutls_cipher_self_test(unsigned flags, gnutls_cipher_algorithm_t cipher);
|
||||
int gnutls_mac_self_test(unsigned flags, gnutls_mac_algorithm_t mac);
|
||||
int gnutls_digest_self_test(unsigned flags, gnutls_digest_algorithm_t digest);
|
||||
int gnutls_pk_self_test(unsigned flags, gnutls_pk_algorithm_t pk);
|
||||
+int gnutls_hkdf_self_test(unsigned flags, gnutls_mac_algorithm_t mac);
|
||||
|
||||
#endif
|
||||
diff --git a/lib/libgnutls.map b/lib/libgnutls.map
|
||||
index 61276e534..386b66f83 100644
|
||||
--- a/lib/libgnutls.map
|
||||
+++ b/lib/libgnutls.map
|
||||
@@ -1347,6 +1347,7 @@ GNUTLS_FIPS140_3_4 {
|
||||
gnutls_pk_self_test;
|
||||
gnutls_mac_self_test;
|
||||
gnutls_digest_self_test;
|
||||
+ gnutls_hkdf_self_test;
|
||||
#for FIPS140-2 validation
|
||||
drbg_aes_reseed;
|
||||
drbg_aes_init;
|
||||
--
|
||||
2.26.2
|
||||
|
||||
|
||||
From 31cc94275cd267f4e0db60999cc932fd76d43d5a Mon Sep 17 00:00:00 2001
|
||||
From: Daiki Ueno <ueno@gnu.org>
|
||||
Date: Mon, 5 Oct 2020 16:59:50 +0200
|
||||
Subject: [PATCH 2/4] fips: add self-tests for PBKDF2
|
||||
|
||||
FIPS140-2 IG D.8 mandates self-tests on approved KDF algorithms. As
|
||||
the guidance only requires running a single instance of each KDF
|
||||
mechanism, this only exercises PBKDF2 with HMAC-SHA-256 as the
|
||||
underlying MAC algorithm.
|
||||
|
||||
Signed-off-by: Daiki Ueno <ueno@gnu.org>
|
||||
---
|
||||
devel/libgnutls-latest-x86_64.abi | 1 +
|
||||
lib/crypto-selftests.c | 107 ++++++++++++++++++++++++++++++
|
||||
lib/fips.c | 7 ++
|
||||
lib/includes/gnutls/self-test.h | 1 +
|
||||
lib/libgnutls.map | 1 +
|
||||
5 files changed, 117 insertions(+)
|
||||
|
||||
diff --git a/lib/crypto-selftests.c b/lib/crypto-selftests.c
|
||||
index bd148b6af..c4b0bd207 100644
|
||||
--- a/lib/crypto-selftests.c
|
||||
+++ b/lib/crypto-selftests.c
|
||||
@@ -3076,3 +3076,110 @@ int gnutls_hkdf_self_test(unsigned flags, gnutls_mac_algorithm_t mac)
|
||||
|
||||
return 0;
|
||||
}
|
||||
+
|
||||
+struct pbkdf2_vectors_st {
|
||||
+ const uint8_t *key;
|
||||
+ size_t key_size;
|
||||
+ const uint8_t *salt;
|
||||
+ size_t salt_size;
|
||||
+ unsigned iter_count;
|
||||
+ const uint8_t *output;
|
||||
+ size_t output_size;
|
||||
+};
|
||||
+
|
||||
+const struct pbkdf2_vectors_st pbkdf2_sha256_vectors[] = {
|
||||
+ /* RFC 7914: 11. Test Vectors for PBKDF2 with HMAC-SHA-256 */
|
||||
+ {
|
||||
+ STR(key, key_size, "passwd"),
|
||||
+ STR(salt, salt_size, "salt"),
|
||||
+ .iter_count = 1,
|
||||
+ STR(output, output_size,
|
||||
+ "\x55\xac\x04\x6e\x56\xe3\x08\x9f\xec\x16\x91\xc2\x25\x44"
|
||||
+ "\xb6\x05\xf9\x41\x85\x21\x6d\xde\x04\x65\xe6\x8b\x9d\x57"
|
||||
+ "\xc2\x0d\xac\xbc\x49\xca\x9c\xcc\xf1\x79\xb6\x45\x99\x16"
|
||||
+ "\x64\xb3\x9d\x77\xef\x31\x7c\x71\xb8\x45\xb1\xe3\x0b\xd5"
|
||||
+ "\x09\x11\x20\x41\xd3\xa1\x97\x83"),
|
||||
+ },
|
||||
+ /* RFC 7914: 11. Test Vectors for PBKDF2 with HMAC-SHA-256 */
|
||||
+ {
|
||||
+ STR(key, key_size, "Password"),
|
||||
+ STR(salt, salt_size, "NaCl"),
|
||||
+ .iter_count = 80000,
|
||||
+ STR(output, output_size,
|
||||
+ "\x4d\xdc\xd8\xf6\x0b\x98\xbe\x21\x83\x0c\xee\x5e\xf2\x27"
|
||||
+ "\x01\xf9\x64\x1a\x44\x18\xd0\x4c\x04\x14\xae\xff\x08\x87"
|
||||
+ "\x6b\x34\xab\x56\xa1\xd4\x25\xa1\x22\x58\x33\x54\x9a\xdb"
|
||||
+ "\x84\x1b\x51\xc9\xb3\x17\x6a\x27\x2b\xde\xbb\xa1\xd0\x78"
|
||||
+ "\x47\x8f\x62\xb3\x97\xf3\x3c\x8d"),
|
||||
+ },
|
||||
+};
|
||||
+
|
||||
+static int test_pbkdf2(gnutls_mac_algorithm_t mac,
|
||||
+ const struct pbkdf2_vectors_st *vectors,
|
||||
+ size_t vectors_size, unsigned flags)
|
||||
+{
|
||||
+ unsigned int i;
|
||||
+
|
||||
+ for (i = 0; i < vectors_size; i++) {
|
||||
+ gnutls_datum_t key, salt;
|
||||
+ uint8_t output[4096];
|
||||
+ int ret;
|
||||
+
|
||||
+ key.data = (void *) vectors[i].key;
|
||||
+ key.size = vectors[i].key_size;
|
||||
+ salt.data = (void *) vectors[i].salt;
|
||||
+ salt.size = vectors[i].salt_size;
|
||||
+
|
||||
+ ret = gnutls_pbkdf2(mac, &key, &salt, vectors[i].iter_count,
|
||||
+ output, vectors[i].output_size);
|
||||
+ if (ret < 0) {
|
||||
+ _gnutls_debug_log("error calculating PBKDF2: MAC-%s\n",
|
||||
+ gnutls_mac_get_name(mac));
|
||||
+ return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
+ }
|
||||
+
|
||||
+ if (memcmp(output, vectors[i].output, vectors[i].output_size) != 0) {
|
||||
+ _gnutls_debug_log
|
||||
+ ("PBKDF2: MAC-%s test vector failed!\n",
|
||||
+ gnutls_mac_get_name(mac));
|
||||
+
|
||||
+ return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ _gnutls_debug_log
|
||||
+ ("PBKDF2: MAC-%s self check succeeded\n",
|
||||
+ gnutls_mac_get_name(mac));
|
||||
+
|
||||
+ return 0;
|
||||
+}
|
||||
+
|
||||
+/*-
|
||||
+ * gnutls_pbkdf2_self_test:
|
||||
+ * @flags: GNUTLS_SELF_TEST_FLAG flags
|
||||
+ * @mac: the message authentication algorithm to use
|
||||
+ *
|
||||
+ * This function will run self tests on PBKDF2 with the provided mac.
|
||||
+ *
|
||||
+ * Returns: Zero or a negative error code on error.
|
||||
+ *
|
||||
+ * Since: 3.3.0-FIPS140
|
||||
+ -*/
|
||||
+int gnutls_pbkdf2_self_test(unsigned flags, gnutls_mac_algorithm_t mac)
|
||||
+{
|
||||
+ int ret;
|
||||
+
|
||||
+ if (flags & GNUTLS_SELF_TEST_FLAG_ALL)
|
||||
+ mac = GNUTLS_MAC_UNKNOWN;
|
||||
+
|
||||
+ switch (mac) {
|
||||
+ case GNUTLS_MAC_UNKNOWN:
|
||||
+ CASE(GNUTLS_MAC_SHA256, test_pbkdf2, pbkdf2_sha256_vectors);
|
||||
+
|
||||
+ break;
|
||||
+ default:
|
||||
+ return gnutls_assert_val(GNUTLS_E_NO_SELF_TEST);
|
||||
+ }
|
||||
+
|
||||
+ return 0;
|
||||
+}
|
||||
diff --git a/lib/fips.c b/lib/fips.c
|
||||
index 48891ed57..7cfab1049 100644
|
||||
--- a/lib/fips.c
|
||||
+++ b/lib/fips.c
|
||||
@@ -430,6 +430,13 @@ int _gnutls_fips_perform_self_checks2(void)
|
||||
goto error;
|
||||
}
|
||||
|
||||
+ /* PBKDF2 */
|
||||
+ ret = gnutls_pbkdf2_self_test(0, GNUTLS_MAC_SHA256);
|
||||
+ if (ret < 0) {
|
||||
+ gnutls_assert();
|
||||
+ goto error;
|
||||
+ }
|
||||
+
|
||||
if (_gnutls_rnd_ops.self_test == NULL) {
|
||||
gnutls_assert();
|
||||
goto error;
|
||||
diff --git a/lib/includes/gnutls/self-test.h b/lib/includes/gnutls/self-test.h
|
||||
index 9b7be8159..958c0da8f 100644
|
||||
--- a/lib/includes/gnutls/self-test.h
|
||||
+++ b/lib/includes/gnutls/self-test.h
|
||||
@@ -35,5 +35,6 @@ int gnutls_mac_self_test(unsigned flags, gnutls_mac_algorithm_t mac);
|
||||
int gnutls_digest_self_test(unsigned flags, gnutls_digest_algorithm_t digest);
|
||||
int gnutls_pk_self_test(unsigned flags, gnutls_pk_algorithm_t pk);
|
||||
int gnutls_hkdf_self_test(unsigned flags, gnutls_mac_algorithm_t mac);
|
||||
+int gnutls_pbkdf2_self_test(unsigned flags, gnutls_mac_algorithm_t mac);
|
||||
|
||||
#endif
|
||||
diff --git a/lib/libgnutls.map b/lib/libgnutls.map
|
||||
index 386b66f83..f5537a386 100644
|
||||
--- a/lib/libgnutls.map
|
||||
+++ b/lib/libgnutls.map
|
||||
@@ -1348,6 +1348,7 @@ GNUTLS_FIPS140_3_4 {
|
||||
gnutls_mac_self_test;
|
||||
gnutls_digest_self_test;
|
||||
gnutls_hkdf_self_test;
|
||||
+ gnutls_pbkdf2_self_test;
|
||||
#for FIPS140-2 validation
|
||||
drbg_aes_reseed;
|
||||
drbg_aes_init;
|
||||
--
|
||||
2.26.2
|
||||
|
||||
|
||||
From d1a3235e8c829855969d00364d8b5456fce2c78c Mon Sep 17 00:00:00 2001
|
||||
From: Daiki Ueno <ueno@gnu.org>
|
||||
Date: Mon, 5 Oct 2020 17:44:30 +0200
|
||||
Subject: [PATCH 3/4] fips: add self-tests for TLS-PRF
|
||||
|
||||
FIPS140-2 IG D.8 mandates self-tests on approved KDF algorithms. As
|
||||
the guidance only requires to run a single instance of each KDF
|
||||
mechanism, this only exercises TLS1.2 PRF with HMAC-SHA-256 as the
|
||||
underlying MAC algorithm.
|
||||
|
||||
Signed-off-by: Daiki Ueno <ueno@gnu.org>
|
||||
---
|
||||
devel/libgnutls-latest-x86_64.abi | 1 +
|
||||
lib/crypto-selftests.c | 196 ++++++++++++++++++++++++++++++
|
||||
lib/fips.c | 7 ++
|
||||
lib/includes/gnutls/self-test.h | 1 +
|
||||
lib/libgnutls.map | 1 +
|
||||
5 files changed, 206 insertions(+)
|
||||
|
||||
diff --git a/lib/crypto-selftests.c b/lib/crypto-selftests.c
|
||||
index c4b0bd207..b740936d6 100644
|
||||
--- a/lib/crypto-selftests.c
|
||||
+++ b/lib/crypto-selftests.c
|
||||
@@ -3183,3 +3183,199 @@ int gnutls_pbkdf2_self_test(unsigned flags, gnutls_mac_algorithm_t mac)
|
||||
|
||||
return 0;
|
||||
}
|
||||
+
|
||||
+struct tlsprf_vectors_st {
|
||||
+ const uint8_t *key;
|
||||
+ size_t key_size;
|
||||
+ const uint8_t *label;
|
||||
+ size_t label_size;
|
||||
+ const uint8_t *seed;
|
||||
+ size_t seed_size;
|
||||
+ const uint8_t *output;
|
||||
+ size_t output_size;
|
||||
+};
|
||||
+
|
||||
+const struct tlsprf_vectors_st tls10prf_vectors[] = {
|
||||
+ /* tests/tls10-prf.c: test1 */
|
||||
+ {
|
||||
+ STR(key, key_size,
|
||||
+ "\x26\x3b\xdb\xbb\x6f\x6d\x4c\x66\x4e\x05\x8d\x0a\xa9\xd3"
|
||||
+ "\x21\xbe"),
|
||||
+ STR(label, label_size,
|
||||
+ "test label"),
|
||||
+ STR(seed, seed_size,
|
||||
+ "\xb9\x20\x57\x3b\x19\x96\x01\x02\x4f\x04\xd6\xdc\x61\x96"
|
||||
+ "\x6e\x65"),
|
||||
+ STR(output, output_size,
|
||||
+ "\x66\x17\x99\x37\x65\xfa\x6c\xa7\x03\xd1\x9e\xc7\x0d\xd5"
|
||||
+ "\xdd\x16\x0f\xfc\xc0\x77\x25\xfa\xfb\x71\x4a\x9f\x81\x5a"
|
||||
+ "\x2a\x30\xbf\xb7\xe3\xbb\xfb\x7e\xee\x57\x4b\x3b\x61\x3e"
|
||||
+ "\xb7\xfe\x80\xee\xc9\x69\x1d\x8c\x1b\x0e\x2d\x9b\x3c\x8b"
|
||||
+ "\x4b\x02\xb6\xb6\xd6\xdb\x88\xe2\x09\x46\x23\xef\x62\x40"
|
||||
+ "\x60\x7e\xda\x7a\xbe\x3c\x84\x6e\x82\xa3"),
|
||||
+ },
|
||||
+};
|
||||
+
|
||||
+const struct tlsprf_vectors_st tls12prf_sha256_vectors[] = {
|
||||
+ /* tests/tls12-prf.c: sha256_test1 */
|
||||
+ {
|
||||
+ STR(key, key_size,
|
||||
+ "\x04\x50\xb0\xea\x9e\xcd\x36\x02\xee\x0d\x76\xc5\xc3\xc8"
|
||||
+ "\x6f\x4a"),
|
||||
+ STR(label, label_size,
|
||||
+ "test label"),
|
||||
+ STR(seed, seed_size,
|
||||
+ "\x20\x7a\xcc\x02\x54\xb8\x67\xf5\xb9\x25\xb4\x5a\x33\x60"
|
||||
+ "\x1d\x8b"),
|
||||
+ STR(output, output_size,
|
||||
+ "\xae\x67\x9e\x0e\x71\x4f\x59\x75\x76\x37\x68\xb1\x66\x97"
|
||||
+ "\x9e\x1d"),
|
||||
+ },
|
||||
+ /* tests/tls12-prf.c: sha256_test2 */
|
||||
+ {
|
||||
+ STR(key, key_size,
|
||||
+ "\x34\x20\x4a\x9d\xf0\xbe\x6e\xb4\xe9\x25\xa8\x02\x7c\xf6"
|
||||
+ "\xc6\x02"),
|
||||
+ STR(label, label_size,
|
||||
+ "test label"),
|
||||
+ STR(seed, seed_size,
|
||||
+ "\x98\xb2\xc4\x0b\xcd\x66\x4c\x83\xbb\x92\x0c\x18\x20\x1a"
|
||||
+ "\x63\x95"),
|
||||
+ STR(output, output_size,
|
||||
+ "\xaf\xa9\x31\x24\x53\xc2\x2f\xa8\x3d\x2b\x51\x1b\x37\x2d"
|
||||
+ "\x73\xa4\x02\xa2\xa6\x28\x73\x23\x9a\x51\xfa\xde\x45\x08"
|
||||
+ "\x2f\xaf\x3f\xd2\xbb\x7f\xfb\x3e\x9b\xf3\x6e\x28\xb3\x14"
|
||||
+ "\x1a\xab\xa4\x84\x00\x53\x32\xa9\xf9\xe3\x88\xa4\xd3\x29"
|
||||
+ "\xf1\x58\x7a\x4b\x31\x7d\xa0\x77\x08\xea\x1b\xa9\x5a\x53"
|
||||
+ "\xf8\x78\x67\x24\xbd\x83\xce\x4b\x03\xaf"),
|
||||
+ },
|
||||
+ /* tests/tls12-prf.c: sha256_test3 */
|
||||
+ {
|
||||
+ STR(key, key_size,
|
||||
+ "\xa3\x69\x1a\xa1\xf6\x81\x4b\x80\x59\x2b\xf1\xcf\x2a\xcf"
|
||||
+ "\x16\x97"),
|
||||
+ STR(label, label_size,
|
||||
+ "test label"),
|
||||
+ STR(seed, seed_size,
|
||||
+ "\x55\x23\xd4\x1e\x32\x0e\x69\x4d\x0c\x1f\xf5\x73\x4d\x83"
|
||||
+ "\x0b\x93\x3e\x46\x92\x70\x71\xc9\x26\x21"),
|
||||
+ STR(output, output_size,
|
||||
+ "\x6a\xd0\x98\x4f\xa0\x6f\x78\xfe\x16\x1b\xd4\x6d\x7c\x26"
|
||||
+ "\x1d\xe4\x33\x40\xd7\x28\xdd\xdc\x3d\x0f\xf0\xdd\x7e\x0d"),
|
||||
+ },
|
||||
+ /* tests/tls12-prf.c: sha256_test4 */
|
||||
+ {
|
||||
+ STR(key, key_size,
|
||||
+ "\x21\x0e\xc9\x37\x06\x97\x07\xe5\x46\x5b\xc4\x6b\xf7\x79"
|
||||
+ "\xe1\x04\x10\x8b\x18\xfd\xb7\x93\xbe\x7b\x21\x8d\xbf\x14"
|
||||
+ "\x5c\x86\x41\xf3"),
|
||||
+ STR(label, label_size,
|
||||
+ "test label"),
|
||||
+ STR(seed, seed_size,
|
||||
+ "\x1e\x35\x1a\x0b\xaf\x35\xc7\x99\x45\x92\x43\x94\xb8\x81"
|
||||
+ "\xcf\xe3\x1d\xae\x8f\x1c\x1e\xd5\x4d\x3b"),
|
||||
+ STR(output, output_size,
|
||||
+ "\x76\x53\xfa\x80\x9c\xde\x3b\x55\x3c\x4a\x17\xe2\xcd\xbc"
|
||||
+ "\xc9\x18\xf3\x65\x27\xf2\x22\x19\xa7\xd7\xf9\x5d\x97\x24"
|
||||
+ "\x3f\xf2\xd5\xde\xe8\x26\x5e\xf0\xaf\x03"),
|
||||
+ },
|
||||
+};
|
||||
+
|
||||
+const struct tlsprf_vectors_st tls12prf_sha384_vectors[] = {
|
||||
+ /* tests/tls12-prf.c: sha384_test1
|
||||
+ * https://www.ietf.org/mail-archive/web/tls/current/msg03416.html
|
||||
+ */
|
||||
+ {
|
||||
+ STR(key, key_size,
|
||||
+ "\xb8\x0b\x73\x3d\x6c\xee\xfc\xdc\x71\x56\x6e\xa4\x8e\x55"
|
||||
+ "\x67\xdf"),
|
||||
+ STR(label, label_size,
|
||||
+ "test label"),
|
||||
+ STR(seed, seed_size,
|
||||
+ "\xcd\x66\x5c\xf6\xa8\x44\x7d\xd6\xff\x8b\x27\x55\x5e\xdb"
|
||||
+ "\x74\x65"),
|
||||
+ STR(output, output_size,
|
||||
+ "\x7b\x0c\x18\xe9\xce\xd4\x10\xed\x18\x04\xf2\xcf\xa3\x4a"
|
||||
+ "\x33\x6a\x1c\x14\xdf\xfb\x49\x00\xbb\x5f\xd7\x94\x21\x07"
|
||||
+ "\xe8\x1c\x83\xcd\xe9\xca\x0f\xaa\x60\xbe\x9f\xe3\x4f\x82"
|
||||
+ "\xb1\x23\x3c\x91\x46\xa0\xe5\x34\xcb\x40\x0f\xed\x27\x00"
|
||||
+ "\x88\x4f\x9d\xc2\x36\xf8\x0e\xdd\x8b\xfa\x96\x11\x44\xc9"
|
||||
+ "\xe8\xd7\x92\xec\xa7\x22\xa7\xb3\x2f\xc3\xd4\x16\xd4\x73"
|
||||
+ "\xeb\xc2\xc5\xfd\x4a\xbf\xda\xd0\x5d\x91\x84\x25\x9b\x5b"
|
||||
+ "\xf8\xcd\x4d\x90\xfa\x0d\x31\xe2\xde\xc4\x79\xe4\xf1\xa2"
|
||||
+ "\x60\x66\xf2\xee\xa9\xa6\x92\x36\xa3\xe5\x26\x55\xc9\xe9"
|
||||
+ "\xae\xe6\x91\xc8\xf3\xa2\x68\x54\x30\x8d\x5e\xaa\x3b\xe8"
|
||||
+ "\x5e\x09\x90\x70\x3d\x73\xe5\x6f"),
|
||||
+ },
|
||||
+};
|
||||
+
|
||||
+static int test_tlsprf(gnutls_mac_algorithm_t mac,
|
||||
+ const struct tlsprf_vectors_st *vectors,
|
||||
+ size_t vectors_size, unsigned flags)
|
||||
+{
|
||||
+ unsigned int i;
|
||||
+
|
||||
+ for (i = 0; i < vectors_size; i++) {
|
||||
+ char output[4096];
|
||||
+ int ret;
|
||||
+
|
||||
+ ret = _gnutls_prf_raw(mac,
|
||||
+ vectors[i].key_size, vectors[i].key,
|
||||
+ vectors[i].label_size, (const char *)vectors[i].label,
|
||||
+ vectors[i].seed_size, vectors[i].seed,
|
||||
+ vectors[i].output_size, output);
|
||||
+ if (ret < 0) {
|
||||
+ _gnutls_debug_log("error calculating TLS-PRF: MAC-%s\n",
|
||||
+ gnutls_mac_get_name(mac));
|
||||
+ return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
+ }
|
||||
+
|
||||
+ if (memcmp(output, vectors[i].output, vectors[i].output_size) != 0) {
|
||||
+ _gnutls_debug_log
|
||||
+ ("TLS-PRF: MAC-%s test vector failed!\n",
|
||||
+ gnutls_mac_get_name(mac));
|
||||
+
|
||||
+ return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ _gnutls_debug_log
|
||||
+ ("TLS-PRF: MAC-%s self check succeeded\n",
|
||||
+ gnutls_mac_get_name(mac));
|
||||
+
|
||||
+ return 0;
|
||||
+}
|
||||
+
|
||||
+/*-
|
||||
+ * gnutls_tlsprf_self_test:
|
||||
+ * @flags: GNUTLS_SELF_TEST_FLAG flags
|
||||
+ * @mac: the message authentication algorithm to use
|
||||
+ *
|
||||
+ * This function will run self tests on TLS-PRF with the provided mac.
|
||||
+ *
|
||||
+ * Returns: Zero or a negative error code on error.
|
||||
+ *
|
||||
+ * Since: 3.3.0-FIPS140
|
||||
+ -*/
|
||||
+int gnutls_tlsprf_self_test(unsigned flags, gnutls_mac_algorithm_t mac)
|
||||
+{
|
||||
+ int ret;
|
||||
+
|
||||
+ if (flags & GNUTLS_SELF_TEST_FLAG_ALL)
|
||||
+ mac = GNUTLS_MAC_UNKNOWN;
|
||||
+
|
||||
+ switch (mac) {
|
||||
+ case GNUTLS_MAC_UNKNOWN:
|
||||
+ NON_FIPS_CASE(GNUTLS_MAC_MD5_SHA1, test_tlsprf, tls10prf_vectors);
|
||||
+ FALLTHROUGH;
|
||||
+ CASE(GNUTLS_MAC_SHA256, test_tlsprf, tls12prf_sha256_vectors);
|
||||
+ FALLTHROUGH;
|
||||
+ CASE(GNUTLS_MAC_SHA384, test_tlsprf, tls12prf_sha384_vectors);
|
||||
+
|
||||
+ break;
|
||||
+ default:
|
||||
+ return gnutls_assert_val(GNUTLS_E_NO_SELF_TEST);
|
||||
+ }
|
||||
+
|
||||
+ return 0;
|
||||
+}
|
||||
diff --git a/lib/fips.c b/lib/fips.c
|
||||
index 7cfab1049..30d396b2c 100644
|
||||
--- a/lib/fips.c
|
||||
+++ b/lib/fips.c
|
||||
@@ -437,6 +437,13 @@ int _gnutls_fips_perform_self_checks2(void)
|
||||
goto error;
|
||||
}
|
||||
|
||||
+ /* TLS-PRF */
|
||||
+ ret = gnutls_tlsprf_self_test(0, GNUTLS_MAC_SHA256);
|
||||
+ if (ret < 0) {
|
||||
+ gnutls_assert();
|
||||
+ goto error;
|
||||
+ }
|
||||
+
|
||||
if (_gnutls_rnd_ops.self_test == NULL) {
|
||||
gnutls_assert();
|
||||
goto error;
|
||||
diff --git a/lib/includes/gnutls/self-test.h b/lib/includes/gnutls/self-test.h
|
||||
index 958c0da8f..88b5a8dbf 100644
|
||||
--- a/lib/includes/gnutls/self-test.h
|
||||
+++ b/lib/includes/gnutls/self-test.h
|
||||
@@ -36,5 +36,6 @@ int gnutls_digest_self_test(unsigned flags, gnutls_digest_algorithm_t digest);
|
||||
int gnutls_pk_self_test(unsigned flags, gnutls_pk_algorithm_t pk);
|
||||
int gnutls_hkdf_self_test(unsigned flags, gnutls_mac_algorithm_t mac);
|
||||
int gnutls_pbkdf2_self_test(unsigned flags, gnutls_mac_algorithm_t mac);
|
||||
+int gnutls_tlsprf_self_test(unsigned flags, gnutls_mac_algorithm_t mac);
|
||||
|
||||
#endif
|
||||
diff --git a/lib/libgnutls.map b/lib/libgnutls.map
|
||||
index f5537a386..643d400a1 100644
|
||||
--- a/lib/libgnutls.map
|
||||
+++ b/lib/libgnutls.map
|
||||
@@ -1349,6 +1349,7 @@ GNUTLS_FIPS140_3_4 {
|
||||
gnutls_digest_self_test;
|
||||
gnutls_hkdf_self_test;
|
||||
gnutls_pbkdf2_self_test;
|
||||
+ gnutls_tlsprf_self_test;
|
||||
#for FIPS140-2 validation
|
||||
drbg_aes_reseed;
|
||||
drbg_aes_init;
|
||||
--
|
||||
2.26.2
|
||||
|
||||
|
||||
From af3df0102fc377591a6de3112b034d4a492fc92c Mon Sep 17 00:00:00 2001
|
||||
From: Daiki Ueno <ueno@gnu.org>
|
||||
Date: Mon, 5 Oct 2020 17:59:46 +0200
|
||||
Subject: [PATCH 4/4] fips: run CMAC self-tests
|
||||
|
||||
FIPS140-2 IG D.8 mandates self-tests on CMAC.
|
||||
|
||||
Signed-off-by: Daiki Ueno <ueno@gnu.org>
|
||||
---
|
||||
lib/fips.c | 6 ++++++
|
||||
1 file changed, 6 insertions(+)
|
||||
|
||||
diff --git a/lib/fips.c b/lib/fips.c
|
||||
index 30d396b2c..51567953d 100644
|
||||
--- a/lib/fips.c
|
||||
+++ b/lib/fips.c
|
||||
@@ -398,6 +398,12 @@ int _gnutls_fips_perform_self_checks2(void)
|
||||
goto error;
|
||||
}
|
||||
|
||||
+ ret = gnutls_mac_self_test(0, GNUTLS_MAC_AES_CMAC_256);
|
||||
+ if (ret < 0) {
|
||||
+ gnutls_assert();
|
||||
+ goto error;
|
||||
+ }
|
||||
+
|
||||
/* PK */
|
||||
ret = gnutls_pk_self_test(0, GNUTLS_PK_RSA);
|
||||
if (ret < 0) {
|
||||
--
|
||||
2.26.2
|
||||
|
|
@ -0,0 +1,247 @@
|
|||
From 300c6315d2e644ae81b43fa2dd7bbf68b3afb5b2 Mon Sep 17 00:00:00 2001
|
||||
From: Daiki Ueno <ueno@gnu.org>
|
||||
Date: Thu, 18 Nov 2021 19:02:03 +0100
|
||||
Subject: [PATCH 1/2] accelerated: fix CPU feature detection for Intel CPUs
|
||||
|
||||
This fixes read_cpuid_vals to correctly read the CPUID quadruple, as
|
||||
well as to set the bit the ustream CRYPTOGAMS uses to identify Intel
|
||||
CPUs.
|
||||
|
||||
Suggested by Rafael Gieschke in:
|
||||
https://gitlab.com/gnutls/gnutls/-/issues/1282
|
||||
|
||||
Signed-off-by: Daiki Ueno <ueno@gnu.org>
|
||||
---
|
||||
lib/accelerated/x86/x86-common.c | 91 +++++++++++++++++++++++++-------
|
||||
1 file changed, 71 insertions(+), 20 deletions(-)
|
||||
|
||||
diff --git a/lib/accelerated/x86/x86-common.c b/lib/accelerated/x86/x86-common.c
|
||||
index 3845c6b4c9..cf615ef24f 100644
|
||||
--- a/lib/accelerated/x86/x86-common.c
|
||||
+++ b/lib/accelerated/x86/x86-common.c
|
||||
@@ -81,15 +81,38 @@ unsigned int _gnutls_x86_cpuid_s[4];
|
||||
# define bit_AVX 0x10000000
|
||||
#endif
|
||||
|
||||
-#ifndef OSXSAVE_MASK
|
||||
-/* OSXSAVE|FMA|MOVBE */
|
||||
-# define OSXSAVE_MASK (0x8000000|0x1000|0x400000)
|
||||
+#ifndef bit_AVX2
|
||||
+# define bit_AVX2 0x00000020
|
||||
+#endif
|
||||
+
|
||||
+#ifndef bit_AVX512F
|
||||
+# define bit_AVX512F 0x00010000
|
||||
+#endif
|
||||
+
|
||||
+#ifndef bit_AVX512IFMA
|
||||
+# define bit_AVX512IFMA 0x00200000
|
||||
+#endif
|
||||
+
|
||||
+#ifndef bit_AVX512BW
|
||||
+# define bit_AVX512BW 0x40000000
|
||||
+#endif
|
||||
+
|
||||
+#ifndef bit_AVX512VL
|
||||
+# define bit_AVX512VL 0x80000000
|
||||
+#endif
|
||||
+
|
||||
+#ifndef bit_OSXSAVE
|
||||
+# define bit_OSXSAVE 0x8000000
|
||||
#endif
|
||||
|
||||
#ifndef bit_MOVBE
|
||||
# define bit_MOVBE 0x00400000
|
||||
#endif
|
||||
|
||||
+#ifndef OSXSAVE_MASK
|
||||
+# define OSXSAVE_MASK (bit_OSXSAVE|bit_MOVBE)
|
||||
+#endif
|
||||
+
|
||||
#define via_bit_PADLOCK (0x3 << 6)
|
||||
#define via_bit_PADLOCK_PHE (0x3 << 10)
|
||||
#define via_bit_PADLOCK_PHE_SHA512 (0x3 << 25)
|
||||
@@ -127,7 +150,7 @@ static unsigned read_cpuid_vals(unsigned int vals[4])
|
||||
unsigned t1, t2, t3;
|
||||
vals[0] = vals[1] = vals[2] = vals[3] = 0;
|
||||
|
||||
- if (!__get_cpuid(1, &t1, &vals[0], &vals[1], &t2))
|
||||
+ if (!__get_cpuid(1, &t1, &t2, &vals[1], &vals[0]))
|
||||
return 0;
|
||||
/* suppress AVX512; it works conditionally on certain CPUs on the original code */
|
||||
vals[1] &= 0xfffff7ff;
|
||||
@@ -145,7 +168,7 @@ static unsigned check_4th_gen_intel_features(unsigned ecx)
|
||||
{
|
||||
uint32_t xcr0;
|
||||
|
||||
- if ((ecx & OSXSAVE_MASK) != OSXSAVE_MASK)
|
||||
+ if ((ecx & bit_OSXSAVE) != bit_OSXSAVE)
|
||||
return 0;
|
||||
|
||||
#if defined(_MSC_VER) && !defined(__clang__)
|
||||
@@ -233,10 +256,7 @@ static unsigned check_sha(void)
|
||||
#ifdef ASM_X86_64
|
||||
static unsigned check_avx_movbe(void)
|
||||
{
|
||||
- if (check_4th_gen_intel_features(_gnutls_x86_cpuid_s[1]) == 0)
|
||||
- return 0;
|
||||
-
|
||||
- return ((_gnutls_x86_cpuid_s[1] & bit_AVX));
|
||||
+ return (_gnutls_x86_cpuid_s[1] & bit_AVX);
|
||||
}
|
||||
|
||||
static unsigned check_pclmul(void)
|
||||
@@ -514,33 +534,47 @@ void register_x86_padlock_crypto(unsigned capabilities)
|
||||
}
|
||||
#endif
|
||||
|
||||
-static unsigned check_intel_or_amd(void)
|
||||
+enum x86_cpu_vendor {
|
||||
+ X86_CPU_VENDOR_OTHER,
|
||||
+ X86_CPU_VENDOR_INTEL,
|
||||
+ X86_CPU_VENDOR_AMD,
|
||||
+};
|
||||
+
|
||||
+static enum x86_cpu_vendor check_x86_cpu_vendor(void)
|
||||
{
|
||||
unsigned int a, b, c, d;
|
||||
|
||||
- if (!__get_cpuid(0, &a, &b, &c, &d))
|
||||
- return 0;
|
||||
+ if (!__get_cpuid(0, &a, &b, &c, &d)) {
|
||||
+ return X86_CPU_VENDOR_OTHER;
|
||||
+ }
|
||||
|
||||
- if ((memcmp(&b, "Genu", 4) == 0 &&
|
||||
- memcmp(&d, "ineI", 4) == 0 &&
|
||||
- memcmp(&c, "ntel", 4) == 0) ||
|
||||
- (memcmp(&b, "Auth", 4) == 0 &&
|
||||
- memcmp(&d, "enti", 4) == 0 && memcmp(&c, "cAMD", 4) == 0)) {
|
||||
- return 1;
|
||||
+ if (memcmp(&b, "Genu", 4) == 0 &&
|
||||
+ memcmp(&d, "ineI", 4) == 0 &&
|
||||
+ memcmp(&c, "ntel", 4) == 0) {
|
||||
+ return X86_CPU_VENDOR_INTEL;
|
||||
}
|
||||
|
||||
- return 0;
|
||||
+ if (memcmp(&b, "Auth", 4) == 0 &&
|
||||
+ memcmp(&d, "enti", 4) == 0 &&
|
||||
+ memcmp(&c, "cAMD", 4) == 0) {
|
||||
+ return X86_CPU_VENDOR_AMD;
|
||||
+ }
|
||||
+
|
||||
+ return X86_CPU_VENDOR_OTHER;
|
||||
}
|
||||
|
||||
static
|
||||
void register_x86_intel_crypto(unsigned capabilities)
|
||||
{
|
||||
int ret;
|
||||
+ enum x86_cpu_vendor vendor;
|
||||
|
||||
memset(_gnutls_x86_cpuid_s, 0, sizeof(_gnutls_x86_cpuid_s));
|
||||
|
||||
- if (check_intel_or_amd() == 0)
|
||||
+ vendor = check_x86_cpu_vendor();
|
||||
+ if (vendor == X86_CPU_VENDOR_OTHER) {
|
||||
return;
|
||||
+ }
|
||||
|
||||
if (capabilities == 0) {
|
||||
if (!read_cpuid_vals(_gnutls_x86_cpuid_s))
|
||||
@@ -549,6 +583,23 @@ void register_x86_intel_crypto(unsigned capabilities)
|
||||
capabilities_to_intel_cpuid(capabilities);
|
||||
}
|
||||
|
||||
+ /* CRYPTOGAMS uses the (1 << 30) bit as an indicator of Intel CPUs */
|
||||
+ if (vendor == X86_CPU_VENDOR_INTEL) {
|
||||
+ _gnutls_x86_cpuid_s[0] |= 1 << 30;
|
||||
+ } else {
|
||||
+ _gnutls_x86_cpuid_s[0] &= ~(1 << 30);
|
||||
+ }
|
||||
+
|
||||
+ if (!check_4th_gen_intel_features(_gnutls_x86_cpuid_s[1])) {
|
||||
+ _gnutls_x86_cpuid_s[1] &= ~bit_AVX;
|
||||
+
|
||||
+ /* Clear AVX2 bits as well, according to what OpenSSL does.
|
||||
+ * Should we clear bit_AVX512DQ, bit_AVX512PF, bit_AVX512ER, and
|
||||
+ * bit_AVX512CD? */
|
||||
+ _gnutls_x86_cpuid_s[2] &= ~(bit_AVX2|bit_AVX512F|bit_AVX512IFMA|
|
||||
+ bit_AVX512BW|bit_AVX512BW);
|
||||
+ }
|
||||
+
|
||||
if (check_ssse3()) {
|
||||
_gnutls_debug_log("Intel SSSE3 was detected\n");
|
||||
|
||||
--
|
||||
2.37.3
|
||||
|
||||
|
||||
From cd509dac9e6d1bf76fd12c72c1fd61f1708c254a Mon Sep 17 00:00:00 2001
|
||||
From: Daiki Ueno <ueno@gnu.org>
|
||||
Date: Mon, 15 Aug 2022 09:39:18 +0900
|
||||
Subject: [PATCH 2/2] accelerated: clear AVX bits if it cannot be queried
|
||||
through XSAVE
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
The algorithm to detect AVX is described in 14.3 of "Intel® 64 and IA-32
|
||||
Architectures Software Developer’s Manual".
|
||||
|
||||
GnuTLS previously only followed that algorithm when registering the
|
||||
crypto backend, while the CRYPTOGAMS derived SHA code assembly expects
|
||||
that the extension bits are propagated to _gnutls_x86_cpuid_s.
|
||||
|
||||
Signed-off-by: Daiki Ueno <ueno@gnu.org>
|
||||
---
|
||||
lib/accelerated/x86/x86-common.c | 18 ++++++++++++++++--
|
||||
1 file changed, 16 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/lib/accelerated/x86/x86-common.c b/lib/accelerated/x86/x86-common.c
|
||||
index cf615ef24f..655d0c65f2 100644
|
||||
--- a/lib/accelerated/x86/x86-common.c
|
||||
+++ b/lib/accelerated/x86/x86-common.c
|
||||
@@ -210,7 +210,8 @@ static void capabilities_to_intel_cpuid(unsigned capabilities)
|
||||
}
|
||||
|
||||
if (capabilities & INTEL_AVX) {
|
||||
- if ((a[1] & bit_AVX) && check_4th_gen_intel_features(a[1])) {
|
||||
+ if ((a[1] & bit_AVX) && (a[1] & bit_MOVBE) &&
|
||||
+ check_4th_gen_intel_features(a[1])) {
|
||||
_gnutls_x86_cpuid_s[1] |= bit_AVX|bit_MOVBE;
|
||||
} else {
|
||||
_gnutls_debug_log
|
||||
@@ -256,7 +257,7 @@ static unsigned check_sha(void)
|
||||
#ifdef ASM_X86_64
|
||||
static unsigned check_avx_movbe(void)
|
||||
{
|
||||
- return (_gnutls_x86_cpuid_s[1] & bit_AVX);
|
||||
+ return (_gnutls_x86_cpuid_s[1] & (bit_AVX|bit_MOVBE)) == (bit_AVX|bit_MOVBE);
|
||||
}
|
||||
|
||||
static unsigned check_pclmul(void)
|
||||
@@ -579,6 +580,19 @@ void register_x86_intel_crypto(unsigned capabilities)
|
||||
if (capabilities == 0) {
|
||||
if (!read_cpuid_vals(_gnutls_x86_cpuid_s))
|
||||
return;
|
||||
+ if (!check_4th_gen_intel_features(_gnutls_x86_cpuid_s[1])) {
|
||||
+ _gnutls_x86_cpuid_s[1] &= ~bit_AVX;
|
||||
+
|
||||
+ /* Clear AVX2 bits as well, according to what
|
||||
+ * OpenSSL does. Should we clear
|
||||
+ * bit_AVX512DQ, bit_AVX512PF, bit_AVX512ER,
|
||||
+ * and bit_AVX512CD? */
|
||||
+ _gnutls_x86_cpuid_s[2] &= ~(bit_AVX2|
|
||||
+ bit_AVX512F|
|
||||
+ bit_AVX512IFMA|
|
||||
+ bit_AVX512BW|
|
||||
+ bit_AVX512BW);
|
||||
+ }
|
||||
} else {
|
||||
capabilities_to_intel_cpuid(capabilities);
|
||||
}
|
||||
--
|
||||
2.37.3
|
||||
|
|
@ -0,0 +1,474 @@
|
|||
From 0d39e4120bc5ece53c86c5802c546259b8ca286a Mon Sep 17 00:00:00 2001
|
||||
From: Daiki Ueno <ueno@gnu.org>
|
||||
Date: Fri, 12 Jan 2024 17:56:58 +0900
|
||||
Subject: [PATCH] nettle: avoid normalization of mpz_t in deterministic ECDSA
|
||||
|
||||
This removes function calls that potentially leak bit-length of a
|
||||
private key used to calculate a nonce in deterministic ECDSA. Namely:
|
||||
|
||||
- _gnutls_dsa_compute_k has been rewritten to work on always
|
||||
zero-padded mp_limb_t arrays instead of mpz_t
|
||||
- rnd_mpz_func has been replaced with rnd_datum_func, which is backed
|
||||
by a byte array instead of an mpz_t value
|
||||
|
||||
Signed-off-by: Daiki Ueno <ueno@gnu.org>
|
||||
---
|
||||
lib/nettle/int/dsa-compute-k.c | 84 +++++++++++++++++++------------
|
||||
lib/nettle/int/dsa-compute-k.h | 31 +++++++++---
|
||||
lib/nettle/int/ecdsa-compute-k.c | 71 +++++++++-----------------
|
||||
lib/nettle/int/ecdsa-compute-k.h | 8 +--
|
||||
lib/nettle/pk.c | 79 ++++++++++++++++++++---------
|
||||
tests/sign-verify-deterministic.c | 2 +-
|
||||
6 files changed, 158 insertions(+), 117 deletions(-)
|
||||
|
||||
diff --git a/lib/nettle/int/dsa-compute-k.c b/lib/nettle/int/dsa-compute-k.c
|
||||
index 17d63318c4..ddeb6f6d1e 100644
|
||||
--- a/lib/nettle/int/dsa-compute-k.c
|
||||
+++ b/lib/nettle/int/dsa-compute-k.c
|
||||
@@ -31,33 +31,37 @@
|
||||
#include "mpn-base256.h"
|
||||
#include <string.h>
|
||||
|
||||
-#define BITS_TO_LIMBS(bits) (((bits) + GMP_NUMB_BITS - 1) / GMP_NUMB_BITS)
|
||||
-
|
||||
-/* The maximum size of q, choosen from the fact that we support
|
||||
- * 521-bit elliptic curve generator and 512-bit DSA subgroup at
|
||||
- * maximum. */
|
||||
-#define MAX_Q_BITS 521
|
||||
-#define MAX_Q_SIZE ((MAX_Q_BITS + 7) / 8)
|
||||
-#define MAX_Q_LIMBS BITS_TO_LIMBS(MAX_Q_BITS)
|
||||
-
|
||||
-#define MAX_HASH_BITS (MAX_HASH_SIZE * 8)
|
||||
-#define MAX_HASH_LIMBS BITS_TO_LIMBS(MAX_HASH_BITS)
|
||||
-
|
||||
-int
|
||||
-_gnutls_dsa_compute_k(mpz_t k,
|
||||
- const mpz_t q,
|
||||
- const mpz_t x,
|
||||
- gnutls_mac_algorithm_t mac,
|
||||
- const uint8_t *digest,
|
||||
- size_t length)
|
||||
+/* For mini-gmp */
|
||||
+#ifndef GMP_LIMB_BITS
|
||||
+#define GMP_LIMB_BITS GMP_NUMB_BITS
|
||||
+#endif
|
||||
+
|
||||
+static inline int is_zero_limb(mp_limb_t x)
|
||||
+{
|
||||
+ x |= (x << 1);
|
||||
+ return ((x >> 1) - 1) >> (GMP_LIMB_BITS - 1);
|
||||
+}
|
||||
+
|
||||
+static int sec_zero_p(const mp_limb_t *ap, mp_size_t n)
|
||||
+{
|
||||
+ volatile mp_limb_t w;
|
||||
+ mp_size_t i;
|
||||
+
|
||||
+ for (i = 0, w = 0; i < n; i++)
|
||||
+ w |= ap[i];
|
||||
+
|
||||
+ return is_zero_limb(w);
|
||||
+}
|
||||
+
|
||||
+int _gnutls_dsa_compute_k(mp_limb_t *h, const mp_limb_t *q, const mp_limb_t *x,
|
||||
+ mp_size_t qn, mp_bitcnt_t q_bits,
|
||||
+ gnutls_mac_algorithm_t mac, const uint8_t *digest,
|
||||
+ size_t length)
|
||||
{
|
||||
uint8_t V[MAX_HASH_SIZE];
|
||||
uint8_t K[MAX_HASH_SIZE];
|
||||
uint8_t xp[MAX_Q_SIZE];
|
||||
uint8_t tp[MAX_Q_SIZE];
|
||||
- mp_limb_t h[MAX(MAX_Q_LIMBS, MAX_HASH_LIMBS)];
|
||||
- mp_bitcnt_t q_bits = mpz_sizeinbase (q, 2);
|
||||
- mp_size_t qn = mpz_size(q);
|
||||
mp_bitcnt_t h_bits = length * 8;
|
||||
mp_size_t hn = BITS_TO_LIMBS(h_bits);
|
||||
size_t nbytes = (q_bits + 7) / 8;
|
||||
@@ -66,6 +70,7 @@ _gnutls_dsa_compute_k(mpz_t k,
|
||||
mp_limb_t cy;
|
||||
gnutls_hmac_hd_t hd;
|
||||
int ret = 0;
|
||||
+ mp_limb_t scratch[MAX_Q_LIMBS];
|
||||
|
||||
if (unlikely(q_bits > MAX_Q_BITS))
|
||||
return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
|
||||
@@ -73,7 +78,7 @@ _gnutls_dsa_compute_k(mpz_t k,
|
||||
return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
|
||||
|
||||
/* int2octets(x) */
|
||||
- mpn_get_base256(xp, nbytes, mpz_limbs_read(x), qn);
|
||||
+ mpn_get_base256(xp, nbytes, x, qn);
|
||||
|
||||
/* bits2octets(h) */
|
||||
mpn_set_base256(h, hn, digest, length);
|
||||
@@ -97,12 +102,12 @@ _gnutls_dsa_compute_k(mpz_t k,
|
||||
mpn_rshift(h, h, hn, shift % GMP_NUMB_BITS);
|
||||
}
|
||||
|
||||
- cy = mpn_sub_n(h, h, mpz_limbs_read(q), qn);
|
||||
+ cy = mpn_sub_n(h, h, q, qn);
|
||||
/* Fall back to addmul_1, if nettle is linked with mini-gmp. */
|
||||
#ifdef mpn_cnd_add_n
|
||||
- mpn_cnd_add_n(cy, h, h, mpz_limbs_read(q), qn);
|
||||
+ mpn_cnd_add_n(cy, h, h, q, qn);
|
||||
#else
|
||||
- mpn_addmul_1(h, mpz_limbs_read(q), qn, cy != 0);
|
||||
+ mpn_addmul_1(h, q, qn, cy != 0);
|
||||
#endif
|
||||
mpn_get_base256(tp, nbytes, h, qn);
|
||||
|
||||
@@ -178,12 +183,8 @@ _gnutls_dsa_compute_k(mpz_t k,
|
||||
if (tlen * 8 > q_bits)
|
||||
mpn_rshift (h, h, qn, tlen * 8 - q_bits);
|
||||
/* Check if k is in [1,q-1] */
|
||||
- if (!mpn_zero_p (h, qn) &&
|
||||
- mpn_cmp (h, mpz_limbs_read(q), qn) < 0) {
|
||||
- mpn_copyi(mpz_limbs_write(k, qn), h, qn);
|
||||
- mpz_limbs_finish(k, qn);
|
||||
+ if (!sec_zero_p(h, qn) && mpn_sub_n(scratch, h, q, qn))
|
||||
break;
|
||||
- }
|
||||
|
||||
ret = gnutls_hmac_init(&hd, mac, K, length);
|
||||
if (ret < 0)
|
||||
@@ -207,3 +208,24 @@ _gnutls_dsa_compute_k(mpz_t k,
|
||||
|
||||
return ret;
|
||||
}
|
||||
+
|
||||
+/* cancel-out dsa_sign's addition of 1 to random data */
|
||||
+void _gnutls_dsa_compute_k_finish(uint8_t *k, size_t nbytes, mp_limb_t *h,
|
||||
+ mp_size_t n)
|
||||
+{
|
||||
+ /* Fall back to sub_1, if nettle is linked with mini-gmp. */
|
||||
+#ifdef mpn_sec_sub_1
|
||||
+ mp_limb_t t[MAX_Q_LIMBS];
|
||||
+
|
||||
+ mpn_sec_sub_1(h, h, n, 1, t);
|
||||
+#else
|
||||
+ mpn_sub_1(h, h, n, 1);
|
||||
+#endif
|
||||
+ mpn_get_base256(k, nbytes, h, n);
|
||||
+}
|
||||
+
|
||||
+void _gnutls_ecdsa_compute_k_finish(uint8_t *k, size_t nbytes, mp_limb_t *h,
|
||||
+ mp_size_t n)
|
||||
+{
|
||||
+ mpn_get_base256(k, nbytes, h, n);
|
||||
+}
|
||||
diff --git a/lib/nettle/int/dsa-compute-k.h b/lib/nettle/int/dsa-compute-k.h
|
||||
index 64e90e0ca2..e88fce0a6d 100644
|
||||
--- a/lib/nettle/int/dsa-compute-k.h
|
||||
+++ b/lib/nettle/int/dsa-compute-k.h
|
||||
@@ -26,12 +26,29 @@
|
||||
#include <gnutls/gnutls.h>
|
||||
#include <nettle/bignum.h> /* includes gmp.h */
|
||||
|
||||
-int
|
||||
-_gnutls_dsa_compute_k(mpz_t k,
|
||||
- const mpz_t q,
|
||||
- const mpz_t x,
|
||||
- gnutls_mac_algorithm_t mac,
|
||||
- const uint8_t *digest,
|
||||
- size_t length);
|
||||
+#define BITS_TO_LIMBS(bits) (((bits) + GMP_NUMB_BITS - 1) / GMP_NUMB_BITS)
|
||||
+
|
||||
+/* The maximum size of q, chosen from the fact that we support
|
||||
+ * 521-bit elliptic curve generator and 512-bit DSA subgroup at
|
||||
+ * maximum. */
|
||||
+#define MAX_Q_BITS 521
|
||||
+#define MAX_Q_SIZE ((MAX_Q_BITS + 7) / 8)
|
||||
+#define MAX_Q_LIMBS BITS_TO_LIMBS(MAX_Q_BITS)
|
||||
+
|
||||
+#define MAX_HASH_BITS (MAX_HASH_SIZE * 8)
|
||||
+#define MAX_HASH_LIMBS BITS_TO_LIMBS(MAX_HASH_BITS)
|
||||
+
|
||||
+#define DSA_COMPUTE_K_ITCH MAX(MAX_Q_LIMBS, MAX_HASH_LIMBS)
|
||||
+
|
||||
+int _gnutls_dsa_compute_k(mp_limb_t *h, const mp_limb_t *q, const mp_limb_t *x,
|
||||
+ mp_size_t qn, mp_bitcnt_t q_bits,
|
||||
+ gnutls_mac_algorithm_t mac, const uint8_t *digest,
|
||||
+ size_t length);
|
||||
+
|
||||
+void _gnutls_dsa_compute_k_finish(uint8_t *k, size_t nbytes, mp_limb_t *h,
|
||||
+ mp_size_t n);
|
||||
+
|
||||
+void _gnutls_ecdsa_compute_k_finish(uint8_t *k, size_t nbytes, mp_limb_t *h,
|
||||
+ mp_size_t n);
|
||||
|
||||
#endif /* GNUTLS_LIB_NETTLE_INT_DSA_COMPUTE_K_H */
|
||||
diff --git a/lib/nettle/int/ecdsa-compute-k.c b/lib/nettle/int/ecdsa-compute-k.c
|
||||
index 94914ebdfa..819302c1c7 100644
|
||||
--- a/lib/nettle/int/ecdsa-compute-k.c
|
||||
+++ b/lib/nettle/int/ecdsa-compute-k.c
|
||||
@@ -29,67 +29,46 @@
|
||||
#include "dsa-compute-k.h"
|
||||
#include "gnutls_int.h"
|
||||
|
||||
-static inline int
|
||||
-_gnutls_ecc_curve_to_dsa_q(mpz_t *q, gnutls_ecc_curve_t curve)
|
||||
+int _gnutls_ecc_curve_to_dsa_q(mpz_t q, gnutls_ecc_curve_t curve)
|
||||
{
|
||||
switch (curve) {
|
||||
#ifdef ENABLE_NON_SUITEB_CURVES
|
||||
case GNUTLS_ECC_CURVE_SECP192R1:
|
||||
- mpz_init_set_str(*q,
|
||||
- "FFFFFFFFFFFFFFFFFFFFFFFF99DEF836"
|
||||
- "146BC9B1B4D22831",
|
||||
- 16);
|
||||
+ mpz_set_str(q,
|
||||
+ "FFFFFFFFFFFFFFFFFFFFFFFF99DEF836"
|
||||
+ "146BC9B1B4D22831",
|
||||
+ 16);
|
||||
return 0;
|
||||
case GNUTLS_ECC_CURVE_SECP224R1:
|
||||
- mpz_init_set_str(*q,
|
||||
- "FFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2"
|
||||
- "E0B8F03E13DD29455C5C2A3D",
|
||||
- 16);
|
||||
+ mpz_set_str(q,
|
||||
+ "FFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2"
|
||||
+ "E0B8F03E13DD29455C5C2A3D",
|
||||
+ 16);
|
||||
return 0;
|
||||
#endif
|
||||
case GNUTLS_ECC_CURVE_SECP256R1:
|
||||
- mpz_init_set_str(*q,
|
||||
- "FFFFFFFF00000000FFFFFFFFFFFFFFFF"
|
||||
- "BCE6FAADA7179E84F3B9CAC2FC632551",
|
||||
- 16);
|
||||
+ mpz_set_str(q,
|
||||
+ "FFFFFFFF00000000FFFFFFFFFFFFFFFF"
|
||||
+ "BCE6FAADA7179E84F3B9CAC2FC632551",
|
||||
+ 16);
|
||||
return 0;
|
||||
case GNUTLS_ECC_CURVE_SECP384R1:
|
||||
- mpz_init_set_str(*q,
|
||||
- "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
|
||||
- "FFFFFFFFFFFFFFFFC7634D81F4372DDF"
|
||||
- "581A0DB248B0A77AECEC196ACCC52973",
|
||||
- 16);
|
||||
+ mpz_set_str(q,
|
||||
+ "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
|
||||
+ "FFFFFFFFFFFFFFFFC7634D81F4372DDF"
|
||||
+ "581A0DB248B0A77AECEC196ACCC52973",
|
||||
+ 16);
|
||||
return 0;
|
||||
case GNUTLS_ECC_CURVE_SECP521R1:
|
||||
- mpz_init_set_str(*q,
|
||||
- "1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
|
||||
- "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
|
||||
- "FFA51868783BF2F966B7FCC0148F709A"
|
||||
- "5D03BB5C9B8899C47AEBB6FB71E91386"
|
||||
- "409",
|
||||
- 16);
|
||||
+ mpz_set_str(q,
|
||||
+ "1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
|
||||
+ "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
|
||||
+ "FFA51868783BF2F966B7FCC0148F709A"
|
||||
+ "5D03BB5C9B8899C47AEBB6FB71E91386"
|
||||
+ "409",
|
||||
+ 16);
|
||||
return 0;
|
||||
default:
|
||||
return gnutls_assert_val(GNUTLS_E_UNSUPPORTED_SIGNATURE_ALGORITHM);
|
||||
}
|
||||
}
|
||||
-
|
||||
-int
|
||||
-_gnutls_ecdsa_compute_k (mpz_t k,
|
||||
- gnutls_ecc_curve_t curve,
|
||||
- const mpz_t x,
|
||||
- gnutls_mac_algorithm_t mac,
|
||||
- const uint8_t *digest,
|
||||
- size_t length)
|
||||
-{
|
||||
- mpz_t q;
|
||||
- int ret;
|
||||
-
|
||||
- ret = _gnutls_ecc_curve_to_dsa_q(&q, curve);
|
||||
- if (ret < 0)
|
||||
- return gnutls_assert_val(ret);
|
||||
-
|
||||
- ret = _gnutls_dsa_compute_k (k, q, x, mac, digest, length);
|
||||
- mpz_clear(q);
|
||||
- return ret;
|
||||
-}
|
||||
diff --git a/lib/nettle/int/ecdsa-compute-k.h b/lib/nettle/int/ecdsa-compute-k.h
|
||||
index 7ca401d6e4..a7e612bcab 100644
|
||||
--- a/lib/nettle/int/ecdsa-compute-k.h
|
||||
+++ b/lib/nettle/int/ecdsa-compute-k.h
|
||||
@@ -26,12 +26,6 @@
|
||||
#include <gnutls/gnutls.h>
|
||||
#include <nettle/bignum.h> /* includes gmp.h */
|
||||
|
||||
-int
|
||||
-_gnutls_ecdsa_compute_k (mpz_t k,
|
||||
- gnutls_ecc_curve_t curve,
|
||||
- const mpz_t x,
|
||||
- gnutls_mac_algorithm_t mac,
|
||||
- const uint8_t *digest,
|
||||
- size_t length);
|
||||
+int _gnutls_ecc_curve_to_dsa_q(mpz_t q, gnutls_ecc_curve_t curve);
|
||||
|
||||
#endif /* GNUTLS_LIB_NETTLE_INT_ECDSA_COMPUTE_K_H */
|
||||
diff --git a/lib/nettle/pk.c b/lib/nettle/pk.c
|
||||
index 588e9df502..b19fe3804a 100644
|
||||
--- a/lib/nettle/pk.c
|
||||
+++ b/lib/nettle/pk.c
|
||||
@@ -102,10 +102,16 @@ static void rnd_nonce_func(void *_ctx, size_t length, uint8_t * data)
|
||||
}
|
||||
}
|
||||
|
||||
-static void rnd_mpz_func(void *_ctx, size_t length, uint8_t * data)
|
||||
+static void rnd_datum_func(void *ctx, size_t length, uint8_t *data)
|
||||
{
|
||||
- mpz_t *k = _ctx;
|
||||
- nettle_mpz_get_str_256 (length, data, *k);
|
||||
+ gnutls_datum_t *d = ctx;
|
||||
+
|
||||
+ if (length > d->size) {
|
||||
+ memset(data, 0, length - d->size);
|
||||
+ memcpy(data + (length - d->size), d->data, d->size);
|
||||
+ } else {
|
||||
+ memcpy(data, d->data, length);
|
||||
+ }
|
||||
}
|
||||
|
||||
static void rnd_nonce_func_fallback(void *_ctx, size_t length, uint8_t * data)
|
||||
@@ -976,7 +982,10 @@ _wrap_nettle_pk_sign(gnutls_pk_algorithm_t algo,
|
||||
struct dsa_signature sig;
|
||||
int curve_id = pk_params->curve;
|
||||
const struct ecc_curve *curve;
|
||||
- mpz_t k;
|
||||
+ mpz_t q;
|
||||
+ /* 521-bit elliptic curve generator at maximum */
|
||||
+ uint8_t buf[(521 + 7) / 8];
|
||||
+ gnutls_datum_t k = { NULL, 0 };
|
||||
void *random_ctx;
|
||||
nettle_random_func *random_func;
|
||||
|
||||
@@ -1005,19 +1014,32 @@ _wrap_nettle_pk_sign(gnutls_pk_algorithm_t algo,
|
||||
hash_len = vdata->size;
|
||||
}
|
||||
|
||||
- mpz_init(k);
|
||||
+ mpz_init(q);
|
||||
+
|
||||
if (_gnutls_get_lib_state() == LIB_STATE_SELFTEST ||
|
||||
(sign_params->flags & GNUTLS_PK_FLAG_REPRODUCIBLE)) {
|
||||
- ret = _gnutls_ecdsa_compute_k(k,
|
||||
- curve_id,
|
||||
- pk_params->params[ECC_K],
|
||||
- DIG_TO_MAC(sign_params->dsa_dig),
|
||||
- vdata->data,
|
||||
- vdata->size);
|
||||
+ mp_limb_t h[DSA_COMPUTE_K_ITCH];
|
||||
+
|
||||
+ ret = _gnutls_ecc_curve_to_dsa_q(q, curve_id);
|
||||
if (ret < 0)
|
||||
goto ecdsa_cleanup;
|
||||
+
|
||||
+ ret = _gnutls_dsa_compute_k(
|
||||
+ h, mpz_limbs_read(q), priv.p,
|
||||
+ ecc_size(priv.ecc), ecc_bit_size(priv.ecc),
|
||||
+ DIG_TO_MAC(sign_params->dsa_dig), vdata->data,
|
||||
+ vdata->size);
|
||||
+ if (ret < 0)
|
||||
+ goto ecdsa_cleanup;
|
||||
+
|
||||
+ k.data = buf;
|
||||
+ k.size = (ecc_bit_size(priv.ecc) + 7) / 8;
|
||||
+
|
||||
+ _gnutls_ecdsa_compute_k_finish(k.data, k.size, h,
|
||||
+ ecc_size(priv.ecc));
|
||||
+
|
||||
random_ctx = &k;
|
||||
- random_func = rnd_mpz_func;
|
||||
+ random_func = rnd_datum_func;
|
||||
} else {
|
||||
random_ctx = NULL;
|
||||
random_func = rnd_nonce_func;
|
||||
@@ -1038,7 +1060,7 @@ _wrap_nettle_pk_sign(gnutls_pk_algorithm_t algo,
|
||||
ecdsa_cleanup:
|
||||
dsa_signature_clear(&sig);
|
||||
ecc_scalar_zclear(&priv);
|
||||
- mpz_clear(k);
|
||||
+ mpz_clear(q);
|
||||
|
||||
if (ret < 0) {
|
||||
gnutls_assert();
|
||||
@@ -1051,7 +1073,9 @@ _wrap_nettle_pk_sign(gnutls_pk_algorithm_t algo,
|
||||
struct dsa_params pub;
|
||||
bigint_t priv;
|
||||
struct dsa_signature sig;
|
||||
- mpz_t k;
|
||||
+ /* 512-bit DSA subgroup at maximum */
|
||||
+ uint8_t buf[(512 + 7) / 8];
|
||||
+ gnutls_datum_t k = { NULL, 0 };
|
||||
void *random_ctx;
|
||||
nettle_random_func *random_func;
|
||||
|
||||
@@ -1074,21 +1098,27 @@ _wrap_nettle_pk_sign(gnutls_pk_algorithm_t algo,
|
||||
hash_len = vdata->size;
|
||||
}
|
||||
|
||||
- mpz_init(k);
|
||||
if (_gnutls_get_lib_state() == LIB_STATE_SELFTEST ||
|
||||
(sign_params->flags & GNUTLS_PK_FLAG_REPRODUCIBLE)) {
|
||||
- ret = _gnutls_dsa_compute_k(k,
|
||||
- pub.q,
|
||||
- TOMPZ(priv),
|
||||
- DIG_TO_MAC(sign_params->dsa_dig),
|
||||
- vdata->data,
|
||||
- vdata->size);
|
||||
+ mp_limb_t h[DSA_COMPUTE_K_ITCH];
|
||||
+
|
||||
+ ret = _gnutls_dsa_compute_k(
|
||||
+ h, mpz_limbs_read(pub.q),
|
||||
+ mpz_limbs_read(TOMPZ(priv)), mpz_size(pub.q),
|
||||
+ mpz_sizeinbase(pub.q, 2),
|
||||
+ DIG_TO_MAC(sign_params->dsa_dig), vdata->data,
|
||||
+ vdata->size);
|
||||
if (ret < 0)
|
||||
goto dsa_fail;
|
||||
- /* cancel-out dsa_sign's addition of 1 to random data */
|
||||
- mpz_sub_ui (k, k, 1);
|
||||
+
|
||||
+ k.data = buf;
|
||||
+ k.size = (mpz_sizeinbase(pub.q, 2) + 7) / 8;
|
||||
+
|
||||
+ _gnutls_dsa_compute_k_finish(k.data, k.size, h,
|
||||
+ mpz_size(pub.q));
|
||||
+
|
||||
random_ctx = &k;
|
||||
- random_func = rnd_mpz_func;
|
||||
+ random_func = rnd_datum_func;
|
||||
} else {
|
||||
random_ctx = NULL;
|
||||
random_func = rnd_nonce_func;
|
||||
@@ -1108,7 +1138,6 @@ _wrap_nettle_pk_sign(gnutls_pk_algorithm_t algo,
|
||||
|
||||
dsa_fail:
|
||||
dsa_signature_clear(&sig);
|
||||
- mpz_clear(k);
|
||||
|
||||
if (ret < 0) {
|
||||
gnutls_assert();
|
||||
diff --git a/tests/sign-verify-deterministic.c b/tests/sign-verify-deterministic.c
|
||||
index 6e907288ee..25aa553a59 100644
|
||||
--- a/tests/sign-verify-deterministic.c
|
||||
+++ b/tests/sign-verify-deterministic.c
|
||||
@@ -197,7 +197,7 @@ void doit(void)
|
||||
&signature);
|
||||
if (ret < 0)
|
||||
testfail("gnutls_pubkey_verify_data2\n");
|
||||
- success(" - pass");
|
||||
+ success(" - pass\n");
|
||||
|
||||
next:
|
||||
gnutls_free(signature.data);
|
||||
--
|
||||
2.44.0
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
--- gnutls-3.7.2/doc/manpages/p11tool.1 2021-05-29 10:15:22.000000000 +0200
|
||||
+++ gnutls-3.7.2-bootstrapped/doc/manpages/p11tool.1 2021-06-28 09:35:23.000000000 +0200
|
||||
@@ -230,8 +230,9 @@
|
||||
.NOP \f\*[B-Font]\-\-write\f[]
|
||||
Writes the loaded objects to a PKCS #11 token.
|
||||
.sp
|
||||
-It can be used to write private, public keys, certificates or secret keys to a token. Must be combined with
|
||||
- one of \--load-privkey, \--load-pubkey, \--load-certificate option.
|
||||
+It can be used to write private, public keys, certificates or secret keys to a token. Must be combined with one of \--load-privkey, \--load-pubkey, \--load-certificate option.
|
||||
+.sp
|
||||
+When writing a certificate object, its CKA_ID is set to the same CKA_ID of the corresponding public key, if it exists on the token; otherwise it will be derived from the X.509 Subject Key Identifier of the certificate. If this behavior is undesired, write the public key to the token beforehand.
|
||||
.TP
|
||||
.NOP \f\*[B-Font]\-\-delete\f[]
|
||||
Deletes the objects matching the given PKCS #11 URL.
|
|
@ -1,17 +1,19 @@
|
|||
From 57afc290cd3ce2e9752a0ce5cba41ecc78fdc1bd Mon Sep 17 00:00:00 2001
|
||||
From: rpm-build <rpm-build>
|
||||
Date: Sun, 31 Jul 2022 10:39:53 +0900
|
||||
Subject: [PATCH] gnutls-3.7.6-pkcs7-verify.patch
|
||||
From e5dc27d1a457d1b3abc0582cd133910dff0fc309 Mon Sep 17 00:00:00 2001
|
||||
From: Zoltan Fridrich <zfridric@redhat.com>
|
||||
Date: Fri, 22 Jul 2022 12:00:11 +0200
|
||||
Subject: [PATCH] Fix double free during gnutls_pkcs7_verify
|
||||
|
||||
Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
|
||||
---
|
||||
.gitignore | 1 +
|
||||
lib/x509/pkcs7.c | 3 +-
|
||||
tests/Makefile.am | 2 +-
|
||||
tests/Makefile.am | 3 +-
|
||||
tests/pkcs7-verify-double-free.c | 215 +++++++++++++++++++++++++++++++
|
||||
3 files changed, 218 insertions(+), 2 deletions(-)
|
||||
4 files changed, 220 insertions(+), 2 deletions(-)
|
||||
create mode 100644 tests/pkcs7-verify-double-free.c
|
||||
|
||||
diff --git a/lib/x509/pkcs7.c b/lib/x509/pkcs7.c
|
||||
index 1f35fab..d5be7f4 100644
|
||||
index 0ff55ba04b..878f867862 100644
|
||||
--- a/lib/x509/pkcs7.c
|
||||
+++ b/lib/x509/pkcs7.c
|
||||
@@ -1318,7 +1318,8 @@ gnutls_x509_crt_t find_signer(gnutls_pkcs7_t pkcs7, gnutls_x509_trust_list_t tl,
|
||||
|
@ -25,21 +27,22 @@ index 1f35fab..d5be7f4 100644
|
|||
break;
|
||||
}
|
||||
diff --git a/tests/Makefile.am b/tests/Makefile.am
|
||||
index 26e39fb..7a7a4af 100644
|
||||
index b04cb081b4..0563d3c754 100644
|
||||
--- a/tests/Makefile.am
|
||||
+++ b/tests/Makefile.am
|
||||
@@ -233,7 +233,7 @@ ctests += mini-record-2 simple gnutls_hmac_fast set_pkcs12_cred cert certuniquei
|
||||
@@ -220,7 +220,8 @@ ctests += mini-record-2 simple gnutls_hmac_fast set_pkcs12_cred cert certuniquei
|
||||
sign-verify-newapi sign-verify-deterministic iov aead-cipher-vec \
|
||||
tls13-without-timeout-func buffer status-request-revoked \
|
||||
set_x509_ocsp_multi_cli kdf-api keylog-func handshake-write \
|
||||
x509cert-dntypes id-on-xmppAddr tls13-compat-mode ciphersuite-name \
|
||||
- x509-upnconstraint
|
||||
+ x509-upnconstraint pkcs7-verify-double-free
|
||||
|
||||
ctests += tls-channel-binding
|
||||
set_x509_ocsp_multi_cli kdf-api keylog-func \
|
||||
- dtls_hello_random_value tls_hello_random_value x509cert-dntypes
|
||||
+ dtls_hello_random_value tls_hello_random_value x509cert-dntypes \
|
||||
+ pkcs7-verify-double-free
|
||||
|
||||
if HAVE_SECCOMP_TESTS
|
||||
ctests += dtls-with-seccomp tls-with-seccomp dtls-client-with-seccomp tls-client-with-seccomp
|
||||
diff --git a/tests/pkcs7-verify-double-free.c b/tests/pkcs7-verify-double-free.c
|
||||
new file mode 100644
|
||||
index 0000000..fadf307
|
||||
index 0000000000..fadf307829
|
||||
--- /dev/null
|
||||
+++ b/tests/pkcs7-verify-double-free.c
|
||||
@@ -0,0 +1,215 @@
|
||||
|
@ -259,5 +262,5 @@ index 0000000..fadf307
|
|||
+ gnutls_pkcs7_deinit(pkcs7);
|
||||
+}
|
||||
--
|
||||
2.37.1
|
||||
2.37.2
|
||||
|
|
@ -1,7 +1,24 @@
|
|||
diff --color -ruNp a/lib/ext/session_ticket.c b/lib/ext/session_ticket.c
|
||||
--- a/lib/ext/session_ticket.c 2022-05-10 13:55:00.000000000 +0200
|
||||
+++ b/lib/ext/session_ticket.c 2022-11-15 13:30:20.491830382 +0100
|
||||
@@ -624,6 +624,12 @@ gnutls_session_ticket_enable_server(gnut
|
||||
From 9b50d94bf1c8e749d7dfc593c89e689a161444ae Mon Sep 17 00:00:00 2001
|
||||
From: rpm-build <rpm-build>
|
||||
Date: Mon, 26 Jun 2023 09:30:03 +0200
|
||||
Subject: [PATCH] gnutls-3.6.16-rehandshake-tickets.patch
|
||||
|
||||
Signed-off-by: rpm-build <rpm-build>
|
||||
---
|
||||
lib/ext/session_ticket.c | 6 ++
|
||||
lib/ext/session_ticket.h | 1 +
|
||||
lib/libgnutls.map | 2 +
|
||||
lib/state.c | 1 +
|
||||
tests/Makefile.am | 3 +-
|
||||
tests/tls12-rehandshake-ticket.c | 152 +++++++++++++++++++++++++++++++
|
||||
6 files changed, 164 insertions(+), 1 deletion(-)
|
||||
create mode 100644 tests/tls12-rehandshake-ticket.c
|
||||
|
||||
diff --git a/lib/ext/session_ticket.c b/lib/ext/session_ticket.c
|
||||
index 8f22462..8d83a6c 100644
|
||||
--- a/lib/ext/session_ticket.c
|
||||
+++ b/lib/ext/session_ticket.c
|
||||
@@ -618,6 +618,12 @@ gnutls_session_ticket_enable_server(gnutls_session_t session,
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
@ -14,30 +31,33 @@ diff --color -ruNp a/lib/ext/session_ticket.c b/lib/ext/session_ticket.c
|
|||
/*
|
||||
* Return zero if session tickets haven't been enabled.
|
||||
*/
|
||||
diff --color -ruNp a/lib/ext/session_ticket.h b/lib/ext/session_ticket.h
|
||||
--- a/lib/ext/session_ticket.h 2022-02-22 15:34:48.000000000 +0100
|
||||
+++ b/lib/ext/session_ticket.h 2022-11-15 13:30:20.491830382 +0100
|
||||
@@ -36,5 +36,6 @@ int _gnutls_encrypt_session_ticket(gnutl
|
||||
diff --git a/lib/ext/session_ticket.h b/lib/ext/session_ticket.h
|
||||
index da804ec..660c9d3 100644
|
||||
--- a/lib/ext/session_ticket.h
|
||||
+++ b/lib/ext/session_ticket.h
|
||||
@@ -36,5 +36,6 @@ int _gnutls_encrypt_session_ticket(gnutls_session_t session,
|
||||
int _gnutls_decrypt_session_ticket(gnutls_session_t session,
|
||||
const gnutls_datum_t *ticket_data,
|
||||
gnutls_datum_t *state);
|
||||
+void _gnutls_session_ticket_disable_server(gnutls_session_t session);
|
||||
|
||||
#endif /* GNUTLS_LIB_EXT_SESSION_TICKET_H */
|
||||
diff --color -ruNp a/lib/libgnutls.map b/lib/libgnutls.map
|
||||
--- a/lib/libgnutls.map 2022-11-15 13:12:57.781688194 +0100
|
||||
+++ b/lib/libgnutls.map 2022-11-15 13:30:20.492830401 +0100
|
||||
@@ -1510,4 +1510,6 @@ GNUTLS_PRIVATE_3_4 {
|
||||
diff --git a/lib/libgnutls.map b/lib/libgnutls.map
|
||||
index d2f7c0a..6748b3a 100644
|
||||
--- a/lib/libgnutls.map
|
||||
+++ b/lib/libgnutls.map
|
||||
@@ -1432,4 +1432,6 @@ GNUTLS_PRIVATE_3_4 {
|
||||
_gnutls_buffer_unescape;
|
||||
_gnutls_buffer_pop_datum;
|
||||
_gnutls_buffer_clear;
|
||||
# needed by tests/cipher-alignment
|
||||
_gnutls_crypto_register_cipher;
|
||||
+ # needed by tests/tls12-rehandshake-cert-ticket
|
||||
+ _gnutls_session_ticket_disable_server;
|
||||
} GNUTLS_3_4;
|
||||
diff --color -ruNp a/lib/state.c b/lib/state.c
|
||||
--- a/lib/state.c 2022-05-16 17:10:08.000000000 +0200
|
||||
+++ b/lib/state.c 2022-11-15 13:30:20.493830420 +0100
|
||||
@@ -545,6 +545,7 @@ void _gnutls_handshake_internal_state_cl
|
||||
diff --git a/lib/state.c b/lib/state.c
|
||||
index 817a7b8..f1e9daa 100644
|
||||
--- a/lib/state.c
|
||||
+++ b/lib/state.c
|
||||
@@ -452,6 +452,7 @@ void _gnutls_handshake_internal_state_clear(gnutls_session_t session)
|
||||
session->internals.tfo.connect_addrlen = 0;
|
||||
session->internals.tfo.connect_only = 0;
|
||||
session->internals.early_data_received = 0;
|
||||
|
@ -45,21 +65,25 @@ diff --color -ruNp a/lib/state.c b/lib/state.c
|
|||
}
|
||||
|
||||
/**
|
||||
diff --color -ruNp a/tests/Makefile.am b/tests/Makefile.am
|
||||
--- a/tests/Makefile.am 2022-11-15 13:12:58.209696462 +0100
|
||||
+++ b/tests/Makefile.am 2022-11-15 13:30:20.494830440 +0100
|
||||
@@ -234,7 +234,7 @@ ctests += mini-record-2 simple gnutls_hm
|
||||
set_x509_ocsp_multi_cli kdf-api keylog-func handshake-write \
|
||||
x509cert-dntypes id-on-xmppAddr tls13-compat-mode ciphersuite-name \
|
||||
x509-upnconstraint xts-key-check pkcs7-verify-double-free \
|
||||
- fips-rsa-sizes
|
||||
+ fips-rsa-sizes tls12-rehandshake-ticket
|
||||
diff --git a/tests/Makefile.am b/tests/Makefile.am
|
||||
index 0563d3c..7c5f5c4 100644
|
||||
--- a/tests/Makefile.am
|
||||
+++ b/tests/Makefile.am
|
||||
@@ -221,7 +221,8 @@ ctests += mini-record-2 simple gnutls_hmac_fast set_pkcs12_cred cert certuniquei
|
||||
tls13-without-timeout-func buffer status-request-revoked \
|
||||
set_x509_ocsp_multi_cli kdf-api keylog-func \
|
||||
dtls_hello_random_value tls_hello_random_value x509cert-dntypes \
|
||||
- pkcs7-verify-double-free
|
||||
+ pkcs7-verify-double-free \
|
||||
+ tls12-rehandshake-ticket
|
||||
|
||||
ctests += tls-channel-binding
|
||||
|
||||
diff --color -ruNp a/tests/tls12-rehandshake-ticket.c b/tests/tls12-rehandshake-ticket.c
|
||||
--- a/tests/tls12-rehandshake-ticket.c 1970-01-01 01:00:00.000000000 +0100
|
||||
+++ b/tests/tls12-rehandshake-ticket.c 2022-11-15 13:30:20.495830459 +0100
|
||||
if HAVE_SECCOMP_TESTS
|
||||
ctests += dtls-with-seccomp tls-with-seccomp dtls-client-with-seccomp tls-client-with-seccomp
|
||||
diff --git a/tests/tls12-rehandshake-ticket.c b/tests/tls12-rehandshake-ticket.c
|
||||
new file mode 100644
|
||||
index 0000000..f96e46e
|
||||
--- /dev/null
|
||||
+++ b/tests/tls12-rehandshake-ticket.c
|
||||
@@ -0,0 +1,152 @@
|
||||
+/*
|
||||
+ * Copyright (C) 2022 Red Hat, Inc.
|
||||
|
@ -213,3 +237,6 @@ diff --color -ruNp a/tests/tls12-rehandshake-ticket.c b/tests/tls12-rehandshake-
|
|||
+{
|
||||
+ run();
|
||||
+}
|
||||
--
|
||||
2.41.0
|
||||
|
|
@ -0,0 +1,121 @@
|
|||
From fe912c5dba49dcecbd5c32bf8184e60a949af452 Mon Sep 17 00:00:00 2001
|
||||
From: Daiki Ueno <ueno@gnu.org>
|
||||
Date: Wed, 10 Jan 2024 19:13:17 +0900
|
||||
Subject: [PATCH] rsa-psk: minimize branching after decryption
|
||||
|
||||
This moves any non-trivial code between gnutls_privkey_decrypt_data2
|
||||
and the function return in _gnutls_proc_rsa_psk_client_kx up until the
|
||||
decryption. This also avoids an extra memcpy to session->key.key.
|
||||
|
||||
Signed-off-by: Daiki Ueno <ueno@gnu.org>
|
||||
---
|
||||
lib/auth/rsa_psk.c | 68 ++++++++++++++++++++++++----------------------
|
||||
1 file changed, 35 insertions(+), 33 deletions(-)
|
||||
|
||||
diff --git a/lib/auth/rsa_psk.c b/lib/auth/rsa_psk.c
|
||||
index 93c2dc9998..8f3fe5a4bd 100644
|
||||
--- a/lib/auth/rsa_psk.c
|
||||
+++ b/lib/auth/rsa_psk.c
|
||||
@@ -269,7 +269,6 @@ _gnutls_proc_rsa_psk_client_kx(gnutls_session_t session, uint8_t * data,
|
||||
int ret, dsize;
|
||||
ssize_t data_size = _data_size;
|
||||
gnutls_psk_server_credentials_t cred;
|
||||
- gnutls_datum_t premaster_secret = { NULL, 0 };
|
||||
volatile uint8_t ver_maj, ver_min;
|
||||
|
||||
cred = (gnutls_psk_server_credentials_t)
|
||||
@@ -329,24 +328,48 @@ _gnutls_proc_rsa_psk_client_kx(gnutls_session_t session, uint8_t * data,
|
||||
ver_maj = _gnutls_get_adv_version_major(session);
|
||||
ver_min = _gnutls_get_adv_version_minor(session);
|
||||
|
||||
- premaster_secret.data = gnutls_malloc(GNUTLS_MASTER_SIZE);
|
||||
- if (premaster_secret.data == NULL) {
|
||||
+ /* Find the key of this username. A random value will be
|
||||
+ * filled in if the key is not found.
|
||||
+ */
|
||||
+ ret =
|
||||
+ _gnutls_psk_pwd_find_entry(session, info->username, strlen(info->username), &pwd_psk);
|
||||
+ if (ret < 0)
|
||||
+ return gnutls_assert_val(ret);
|
||||
+
|
||||
+ /* Allocate memory for premaster secret, and fill in the
|
||||
+ * fields except the decryption result.
|
||||
+ */
|
||||
+ session->key.key.size = 2 + GNUTLS_MASTER_SIZE + 2 + pwd_psk.size;
|
||||
+ session->key.key.data = gnutls_malloc(session->key.key.size);
|
||||
+ if (session->key.key.data == NULL) {
|
||||
gnutls_assert();
|
||||
+ _gnutls_free_key_datum(&pwd_psk);
|
||||
+ /* No need to zeroize, as the secret is not copied in yet */
|
||||
+ _gnutls_free_datum(&session->key.key);
|
||||
return GNUTLS_E_MEMORY_ERROR;
|
||||
}
|
||||
- premaster_secret.size = GNUTLS_MASTER_SIZE;
|
||||
|
||||
/* Fallback value when decryption fails. Needs to be unpredictable. */
|
||||
- ret = gnutls_rnd(GNUTLS_RND_NONCE, premaster_secret.data,
|
||||
- premaster_secret.size);
|
||||
+ ret = gnutls_rnd(GNUTLS_RND_NONCE, session->key.key.data + 2,
|
||||
+ GNUTLS_MASTER_SIZE);
|
||||
if (ret < 0) {
|
||||
gnutls_assert();
|
||||
- goto cleanup;
|
||||
+ _gnutls_free_key_datum(&pwd_psk);
|
||||
+ /* No need to zeroize, as the secret is not copied in yet */
|
||||
+ _gnutls_free_datum(&session->key.key);
|
||||
+ return ret;
|
||||
}
|
||||
|
||||
+ _gnutls_write_uint16(GNUTLS_MASTER_SIZE, session->key.key.data);
|
||||
+ _gnutls_write_uint16(pwd_psk.size,
|
||||
+ &session->key.key.data[2 + GNUTLS_MASTER_SIZE]);
|
||||
+ memcpy(&session->key.key.data[2 + GNUTLS_MASTER_SIZE + 2],
|
||||
+ pwd_psk.data, pwd_psk.size);
|
||||
+ _gnutls_free_key_datum(&pwd_psk);
|
||||
+
|
||||
gnutls_privkey_decrypt_data2(session->internals.selected_key, 0,
|
||||
- &ciphertext, premaster_secret.data,
|
||||
- premaster_secret.size);
|
||||
+ &ciphertext, session->key.key.data + 2,
|
||||
+ GNUTLS_MASTER_SIZE);
|
||||
/* After this point, any conditional on failure that cause differences
|
||||
* in execution may create a timing or cache access pattern side
|
||||
* channel that can be used as an oracle, so tread carefully */
|
||||
@@ -365,31 +388,10 @@ _gnutls_proc_rsa_psk_client_kx(gnutls_session_t session, uint8_t * data,
|
||||
/* This is here to avoid the version check attack
|
||||
* discussed above.
|
||||
*/
|
||||
- premaster_secret.data[0] = ver_maj;
|
||||
- premaster_secret.data[1] = ver_min;
|
||||
-
|
||||
- /* find the key of this username
|
||||
- */
|
||||
- ret =
|
||||
- _gnutls_psk_pwd_find_entry(session, info->username, strlen(info->username), &pwd_psk);
|
||||
- if (ret < 0) {
|
||||
- gnutls_assert();
|
||||
- goto cleanup;
|
||||
- }
|
||||
-
|
||||
- ret =
|
||||
- set_rsa_psk_session_key(session, &pwd_psk, &premaster_secret);
|
||||
- if (ret < 0) {
|
||||
- gnutls_assert();
|
||||
- goto cleanup;
|
||||
- }
|
||||
+ session->key.key.data[2] = ver_maj;
|
||||
+ session->key.key.data[3] = ver_min;
|
||||
|
||||
- ret = 0;
|
||||
- cleanup:
|
||||
- _gnutls_free_key_datum(&pwd_psk);
|
||||
- _gnutls_free_temp_key_datum(&premaster_secret);
|
||||
-
|
||||
- return ret;
|
||||
+ return 0;
|
||||
}
|
||||
|
||||
static int
|
||||
--
|
||||
2.43.0
|
||||
|
|
@ -0,0 +1,202 @@
|
|||
From e007a54432c98618bde500649817d153225abf6b Mon Sep 17 00:00:00 2001
|
||||
From: rpm-build <rpm-build>
|
||||
Date: Thu, 7 Dec 2023 11:52:08 +0900
|
||||
Subject: [PATCH] gnutls-3.6.16-rsa-psk-timing.patch
|
||||
|
||||
Signed-off-by: rpm-build <rpm-build>
|
||||
---
|
||||
lib/auth/rsa.c | 2 +-
|
||||
lib/auth/rsa_psk.c | 93 +++++++++++++++++-----------------------------
|
||||
lib/gnutls_int.h | 4 --
|
||||
lib/priority.c | 1 -
|
||||
4 files changed, 35 insertions(+), 65 deletions(-)
|
||||
|
||||
diff --git a/lib/auth/rsa.c b/lib/auth/rsa.c
|
||||
index 858701f..02b6a34 100644
|
||||
--- a/lib/auth/rsa.c
|
||||
+++ b/lib/auth/rsa.c
|
||||
@@ -207,7 +207,7 @@ proc_rsa_client_kx(gnutls_session_t session, uint8_t * data,
|
||||
session->key.key.size);
|
||||
/* After this point, any conditional on failure that cause differences
|
||||
* in execution may create a timing or cache access pattern side
|
||||
- * channel that can be used as an oracle, so treat very carefully */
|
||||
+ * channel that can be used as an oracle, so tread carefully */
|
||||
|
||||
/* Error handling logic:
|
||||
* In case decryption fails then don't inform the peer. Just use the
|
||||
diff --git a/lib/auth/rsa_psk.c b/lib/auth/rsa_psk.c
|
||||
index 1a9dab5..93c2dc9 100644
|
||||
--- a/lib/auth/rsa_psk.c
|
||||
+++ b/lib/auth/rsa_psk.c
|
||||
@@ -264,14 +264,13 @@ _gnutls_proc_rsa_psk_client_kx(gnutls_session_t session, uint8_t * data,
|
||||
{
|
||||
gnutls_datum_t username;
|
||||
psk_auth_info_t info;
|
||||
- gnutls_datum_t plaintext;
|
||||
gnutls_datum_t ciphertext;
|
||||
gnutls_datum_t pwd_psk = { NULL, 0 };
|
||||
int ret, dsize;
|
||||
- int randomize_key = 0;
|
||||
ssize_t data_size = _data_size;
|
||||
gnutls_psk_server_credentials_t cred;
|
||||
gnutls_datum_t premaster_secret = { NULL, 0 };
|
||||
+ volatile uint8_t ver_maj, ver_min;
|
||||
|
||||
cred = (gnutls_psk_server_credentials_t)
|
||||
_gnutls_get_cred(session, GNUTLS_CRD_PSK);
|
||||
@@ -327,71 +326,47 @@ _gnutls_proc_rsa_psk_client_kx(gnutls_session_t session, uint8_t * data,
|
||||
}
|
||||
ciphertext.size = dsize;
|
||||
|
||||
- ret =
|
||||
- gnutls_privkey_decrypt_data(session->internals.selected_key, 0,
|
||||
- &ciphertext, &plaintext);
|
||||
- if (ret < 0 || plaintext.size != GNUTLS_MASTER_SIZE) {
|
||||
- /* In case decryption fails then don't inform
|
||||
- * the peer. Just use a random key. (in order to avoid
|
||||
- * attack against pkcs-1 formatting).
|
||||
- */
|
||||
+ ver_maj = _gnutls_get_adv_version_major(session);
|
||||
+ ver_min = _gnutls_get_adv_version_minor(session);
|
||||
+
|
||||
+ premaster_secret.data = gnutls_malloc(GNUTLS_MASTER_SIZE);
|
||||
+ if (premaster_secret.data == NULL) {
|
||||
gnutls_assert();
|
||||
- _gnutls_debug_log
|
||||
- ("auth_rsa_psk: Possible PKCS #1 format attack\n");
|
||||
- if (ret >= 0) {
|
||||
- gnutls_free(plaintext.data);
|
||||
- }
|
||||
- randomize_key = 1;
|
||||
- } else {
|
||||
- /* If the secret was properly formatted, then
|
||||
- * check the version number.
|
||||
- */
|
||||
- if (_gnutls_get_adv_version_major(session) !=
|
||||
- plaintext.data[0]
|
||||
- || (session->internals.allow_wrong_pms == 0
|
||||
- && _gnutls_get_adv_version_minor(session) !=
|
||||
- plaintext.data[1])) {
|
||||
- /* No error is returned here, if the version number check
|
||||
- * fails. We proceed normally.
|
||||
- * That is to defend against the attack described in the paper
|
||||
- * "Attacking RSA-based sessions in SSL/TLS" by Vlastimil Klima,
|
||||
- * Ondej Pokorny and Tomas Rosa.
|
||||
- */
|
||||
- gnutls_assert();
|
||||
- _gnutls_debug_log
|
||||
- ("auth_rsa: Possible PKCS #1 version check format attack\n");
|
||||
- }
|
||||
+ return GNUTLS_E_MEMORY_ERROR;
|
||||
}
|
||||
+ premaster_secret.size = GNUTLS_MASTER_SIZE;
|
||||
|
||||
-
|
||||
- if (randomize_key != 0) {
|
||||
- premaster_secret.size = GNUTLS_MASTER_SIZE;
|
||||
- premaster_secret.data =
|
||||
- gnutls_malloc(premaster_secret.size);
|
||||
- if (premaster_secret.data == NULL) {
|
||||
- gnutls_assert();
|
||||
- return GNUTLS_E_MEMORY_ERROR;
|
||||
- }
|
||||
-
|
||||
- /* we do not need strong random numbers here.
|
||||
- */
|
||||
- ret = gnutls_rnd(GNUTLS_RND_NONCE, premaster_secret.data,
|
||||
- premaster_secret.size);
|
||||
- if (ret < 0) {
|
||||
- gnutls_assert();
|
||||
- goto cleanup;
|
||||
- }
|
||||
- } else {
|
||||
- premaster_secret.data = plaintext.data;
|
||||
- premaster_secret.size = plaintext.size;
|
||||
+ /* Fallback value when decryption fails. Needs to be unpredictable. */
|
||||
+ ret = gnutls_rnd(GNUTLS_RND_NONCE, premaster_secret.data,
|
||||
+ premaster_secret.size);
|
||||
+ if (ret < 0) {
|
||||
+ gnutls_assert();
|
||||
+ goto cleanup;
|
||||
}
|
||||
|
||||
+ gnutls_privkey_decrypt_data2(session->internals.selected_key, 0,
|
||||
+ &ciphertext, premaster_secret.data,
|
||||
+ premaster_secret.size);
|
||||
+ /* After this point, any conditional on failure that cause differences
|
||||
+ * in execution may create a timing or cache access pattern side
|
||||
+ * channel that can be used as an oracle, so tread carefully */
|
||||
+
|
||||
+ /* Error handling logic:
|
||||
+ * In case decryption fails then don't inform the peer. Just use the
|
||||
+ * random key previously generated. (in order to avoid attack against
|
||||
+ * pkcs-1 formatting).
|
||||
+ *
|
||||
+ * If we get version mismatches no error is returned either. We
|
||||
+ * proceed normally. This is to defend against the attack described
|
||||
+ * in the paper "Attacking RSA-based sessions in SSL/TLS" by
|
||||
+ * Vlastimil Klima, Ondej Pokorny and Tomas Rosa.
|
||||
+ */
|
||||
+
|
||||
/* This is here to avoid the version check attack
|
||||
* discussed above.
|
||||
*/
|
||||
-
|
||||
- premaster_secret.data[0] = _gnutls_get_adv_version_major(session);
|
||||
- premaster_secret.data[1] = _gnutls_get_adv_version_minor(session);
|
||||
+ premaster_secret.data[0] = ver_maj;
|
||||
+ premaster_secret.data[1] = ver_min;
|
||||
|
||||
/* find the key of this username
|
||||
*/
|
||||
diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h
|
||||
index 31cec5c..815f69b 100644
|
||||
--- a/lib/gnutls_int.h
|
||||
+++ b/lib/gnutls_int.h
|
||||
@@ -971,7 +971,6 @@ struct gnutls_priority_st {
|
||||
bool _no_etm;
|
||||
bool _no_ext_master_secret;
|
||||
bool _allow_key_usage_violation;
|
||||
- bool _allow_wrong_pms;
|
||||
bool _dumbfw;
|
||||
unsigned int _dh_prime_bits; /* old (deprecated) variable */
|
||||
|
||||
@@ -989,7 +988,6 @@ struct gnutls_priority_st {
|
||||
(x)->no_etm = 1; \
|
||||
(x)->no_ext_master_secret = 1; \
|
||||
(x)->allow_key_usage_violation = 1; \
|
||||
- (x)->allow_wrong_pms = 1; \
|
||||
(x)->dumbfw = 1
|
||||
|
||||
#define ENABLE_PRIO_COMPAT(x) \
|
||||
@@ -998,7 +996,6 @@ struct gnutls_priority_st {
|
||||
(x)->_no_etm = 1; \
|
||||
(x)->_no_ext_master_secret = 1; \
|
||||
(x)->_allow_key_usage_violation = 1; \
|
||||
- (x)->_allow_wrong_pms = 1; \
|
||||
(x)->_dumbfw = 1
|
||||
|
||||
/* DH and RSA parameters types.
|
||||
@@ -1123,7 +1120,6 @@ typedef struct {
|
||||
bool no_etm;
|
||||
bool no_ext_master_secret;
|
||||
bool allow_key_usage_violation;
|
||||
- bool allow_wrong_pms;
|
||||
bool dumbfw;
|
||||
|
||||
/* old (deprecated) variable. This is used for both srp_prime_bits
|
||||
diff --git a/lib/priority.c b/lib/priority.c
|
||||
index 0a284ae..67ec887 100644
|
||||
--- a/lib/priority.c
|
||||
+++ b/lib/priority.c
|
||||
@@ -681,7 +681,6 @@ gnutls_priority_set(gnutls_session_t session, gnutls_priority_t priority)
|
||||
COPY_TO_INTERNALS(no_etm);
|
||||
COPY_TO_INTERNALS(no_ext_master_secret);
|
||||
COPY_TO_INTERNALS(allow_key_usage_violation);
|
||||
- COPY_TO_INTERNALS(allow_wrong_pms);
|
||||
COPY_TO_INTERNALS(dumbfw);
|
||||
COPY_TO_INTERNALS(dh_prime_bits);
|
||||
|
||||
--
|
||||
2.43.0
|
||||
|
|
@ -0,0 +1,125 @@
|
|||
From 339bef12f478b3a12c59571c53645e31280baf7e Mon Sep 17 00:00:00 2001
|
||||
From: Daiki Ueno <ueno@gnu.org>
|
||||
Date: Fri, 14 May 2021 15:59:37 +0200
|
||||
Subject: [PATCH] cert auth: filter out unsupported cert types from TLS 1.2 CR
|
||||
|
||||
When the server is advertising signature algorithms in TLS 1.2
|
||||
CertificateRequest, it shouldn't send certificate_types not backed by
|
||||
any of those algorithms.
|
||||
|
||||
Signed-off-by: Daiki Ueno <ueno@gnu.org>
|
||||
---
|
||||
lib/auth/cert.c | 76 +++++++++++++++++++++++--
|
||||
tests/suite/tls-fuzzer/gnutls-cert.json | 19 +++++++
|
||||
2 files changed, 89 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/lib/auth/cert.c b/lib/auth/cert.c
|
||||
index 3073a33d3..0b0f04b2b 100644
|
||||
--- a/lib/auth/cert.c
|
||||
+++ b/lib/auth/cert.c
|
||||
@@ -64,6 +64,16 @@ typedef enum CertificateSigType { RSA_SIGN = 1, DSA_SIGN = 2, ECDSA_SIGN = 64,
|
||||
#endif
|
||||
} CertificateSigType;
|
||||
|
||||
+enum CertificateSigTypeFlags {
|
||||
+ RSA_SIGN_FLAG = 1,
|
||||
+ DSA_SIGN_FLAG = 1 << 1,
|
||||
+ ECDSA_SIGN_FLAG = 1 << 2,
|
||||
+#ifdef ENABLE_GOST
|
||||
+ GOSTR34102012_256_SIGN_FLAG = 1 << 3,
|
||||
+ GOSTR34102012_512_SIGN_FLAG = 1 << 4
|
||||
+#endif
|
||||
+};
|
||||
+
|
||||
/* Moves data from an internal certificate struct (gnutls_pcert_st) to
|
||||
* another internal certificate struct (cert_auth_info_t), and deinitializes
|
||||
* the former.
|
||||
@@ -1281,6 +1291,7 @@ _gnutls_gen_cert_server_cert_req(gnutls_session_t session,
|
||||
uint8_t tmp_data[CERTTYPE_SIZE];
|
||||
const version_entry_st *ver = get_version(session);
|
||||
unsigned init_pos = data->length;
|
||||
+ enum CertificateSigTypeFlags flags;
|
||||
|
||||
if (unlikely(ver == NULL))
|
||||
return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);
|
||||
@@ -1297,18 +1308,71 @@ _gnutls_gen_cert_server_cert_req(gnutls_session_t session,
|
||||
return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
|
||||
}
|
||||
|
||||
- i = 1;
|
||||
+ if (_gnutls_version_has_selectable_sighash(ver)) {
|
||||
+ size_t j;
|
||||
+
|
||||
+ flags = 0;
|
||||
+ for (j = 0; j < session->internals.priorities->sigalg.size; j++) {
|
||||
+ const gnutls_sign_entry_st *se =
|
||||
+ session->internals.priorities->sigalg.entry[j];
|
||||
+ switch (se->pk) {
|
||||
+ case GNUTLS_PK_RSA:
|
||||
+ case GNUTLS_PK_RSA_PSS:
|
||||
+ flags |= RSA_SIGN_FLAG;
|
||||
+ break;
|
||||
+ case GNUTLS_PK_DSA:
|
||||
+ flags |= DSA_SIGN_FLAG;
|
||||
+ break;
|
||||
+ case GNUTLS_PK_ECDSA:
|
||||
+ flags |= ECDSA_SIGN_FLAG;
|
||||
+ break;
|
||||
#ifdef ENABLE_GOST
|
||||
- if (_gnutls_kx_is_vko_gost(session->security_parameters.cs->kx_algorithm)) {
|
||||
- tmp_data[i++] = GOSTR34102012_256_SIGN;
|
||||
- tmp_data[i++] = GOSTR34102012_512_SIGN;
|
||||
- } else
|
||||
+ case GNUTLS_PK_GOST_12_256:
|
||||
+ flags |= GOSTR34102012_256_SIGN_FLAG;
|
||||
+ break;
|
||||
+ case GNUTLS_PK_GOST_12_512:
|
||||
+ flags |= GOSTR34102012_512_SIGN_FLAG;
|
||||
+ break;
|
||||
+#endif
|
||||
+ default:
|
||||
+ gnutls_assert();
|
||||
+ _gnutls_debug_log(
|
||||
+ "%s is unsupported for cert request\n",
|
||||
+ gnutls_pk_get_name(se->pk));
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ } else {
|
||||
+#ifdef ENABLE_GOST
|
||||
+ if (_gnutls_kx_is_vko_gost(session->security_parameters.
|
||||
+ cs->kx_algorithm)) {
|
||||
+ flags = GOSTR34102012_256_SIGN_FLAG |
|
||||
+ GOSTR34102012_512_SIGN_FLAG;
|
||||
+ } else
|
||||
#endif
|
||||
- {
|
||||
+ {
|
||||
+ flags = RSA_SIGN_FLAG | DSA_SIGN_FLAG | ECDSA_SIGN_FLAG;
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ i = 1;
|
||||
+ if (flags & RSA_SIGN_FLAG) {
|
||||
tmp_data[i++] = RSA_SIGN;
|
||||
+ }
|
||||
+ if (flags & DSA_SIGN_FLAG) {
|
||||
tmp_data[i++] = DSA_SIGN;
|
||||
+ }
|
||||
+ if (flags & ECDSA_SIGN_FLAG) {
|
||||
tmp_data[i++] = ECDSA_SIGN;
|
||||
}
|
||||
+#ifdef ENABLE_GOST
|
||||
+ if (flags & GOSTR34102012_256_SIGN_FLAG) {
|
||||
+ tmp_data[i++] = GOSTR34102012_256_SIGN;
|
||||
+ }
|
||||
+ if (flags & GOSTR34102012_512_SIGN_FLAG) {
|
||||
+ tmp_data[i++] = GOSTR34102012_512_SIGN;
|
||||
+ }
|
||||
+#endif
|
||||
tmp_data[0] = i - 1;
|
||||
|
||||
ret = _gnutls_buffer_append_data(data, tmp_data, i);
|
||||
--
|
||||
2.31.1
|
||||
|
|
@ -0,0 +1,283 @@
|
|||
From c2409e479df41620bceac314c76cabb1d35a4075 Mon Sep 17 00:00:00 2001
|
||||
From: Daiki Ueno <ueno@gnu.org>
|
||||
Date: Mon, 3 May 2021 16:35:43 +0200
|
||||
Subject: [PATCH] x509/verify: treat SHA-1 signed CA in the trusted set
|
||||
differently
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
Suppose there is a certificate chain ending with an intermediate CA:
|
||||
EE → ICA1 → ICA2. If the system trust store contains a root CA
|
||||
generated with the same key as ICA2 but signed with a prohibited
|
||||
algorithm, such as SHA-1, the library previously reported a
|
||||
verification failure, though the situation is not uncommon during a
|
||||
transition period of root CA.
|
||||
|
||||
This changes the library behavior such that the check on signature
|
||||
algorithm will be skipped when examining the trusted root CA.
|
||||
|
||||
Signed-off-by: Daiki Ueno <ueno@gnu.org>
|
||||
---
|
||||
lib/x509/verify.c | 26 ++++---
|
||||
tests/test-chains.h | 165 ++++++++++++++++++++++++++++++++++++++++++++
|
||||
2 files changed, 182 insertions(+), 9 deletions(-)
|
||||
|
||||
diff --git a/lib/x509/verify.c b/lib/x509/verify.c
|
||||
index fd7c6a164..a50b5ea44 100644
|
||||
--- a/lib/x509/verify.c
|
||||
+++ b/lib/x509/verify.c
|
||||
@@ -415,14 +415,19 @@ unsigned _gnutls_is_broken_sig_allowed(const gnutls_sign_entry_st *se, unsigned
|
||||
#define CASE_SEC_PARAM(profile, level) \
|
||||
case profile: \
|
||||
sym_bits = gnutls_sec_param_to_symmetric_bits(level); \
|
||||
- hash = gnutls_sign_get_hash_algorithm(sigalg); \
|
||||
- entry = mac_to_entry(hash); \
|
||||
- if (hash <= 0 || entry == NULL) { \
|
||||
+ se = _gnutls_sign_to_entry(sigalg); \
|
||||
+ if (unlikely(se == NULL)) { \
|
||||
+ _gnutls_cert_log("cert", crt); \
|
||||
+ _gnutls_debug_log(#level": certificate's signature algorithm is unknown\n"); \
|
||||
+ return gnutls_assert_val(0); \
|
||||
+ } \
|
||||
+ if (unlikely(se->hash == GNUTLS_DIG_UNKNOWN)) { \
|
||||
_gnutls_cert_log("cert", crt); \
|
||||
_gnutls_debug_log(#level": certificate's signature hash is unknown\n"); \
|
||||
return gnutls_assert_val(0); \
|
||||
} \
|
||||
- if (_gnutls_sign_get_hash_strength(sigalg) < sym_bits) { \
|
||||
+ if (!trusted && \
|
||||
+ _gnutls_sign_get_hash_strength(sigalg) < sym_bits) { \
|
||||
_gnutls_cert_log("cert", crt); \
|
||||
_gnutls_debug_log(#level": certificate's signature hash strength is unacceptable (is %u bits, needed %u)\n", _gnutls_sign_get_hash_strength(sigalg), sym_bits); \
|
||||
return gnutls_assert_val(0); \
|
||||
@@ -449,19 +454,22 @@ unsigned _gnutls_is_broken_sig_allowed(const gnutls_sign_entry_st *se, unsigned
|
||||
* @crt: a certificate
|
||||
* @issuer: the certificates issuer (allowed to be NULL)
|
||||
* @sigalg: the signature algorithm used
|
||||
+ * @trusted: whether @crt is treated as trusted (e.g., present in the system
|
||||
+ * trust list); if it is true, the check on signature algorithm will
|
||||
+ * be skipped
|
||||
* @flags: the specified verification flags
|
||||
*/
|
||||
static unsigned is_level_acceptable(
|
||||
gnutls_x509_crt_t crt, gnutls_x509_crt_t issuer,
|
||||
- gnutls_sign_algorithm_t sigalg, unsigned flags)
|
||||
+ gnutls_sign_algorithm_t sigalg, bool trusted,
|
||||
+ unsigned flags)
|
||||
{
|
||||
gnutls_certificate_verification_profiles_t profile = GNUTLS_VFLAGS_TO_PROFILE(flags);
|
||||
- const mac_entry_st *entry;
|
||||
int issuer_pkalg = 0, pkalg, ret;
|
||||
unsigned bits = 0, issuer_bits = 0, sym_bits = 0;
|
||||
gnutls_pk_params_st params;
|
||||
gnutls_sec_param_t sp;
|
||||
- int hash;
|
||||
+ const gnutls_sign_entry_st *se;
|
||||
gnutls_certificate_verification_profiles_t min_profile;
|
||||
|
||||
min_profile = _gnutls_get_system_wide_verification_profile();
|
||||
@@ -798,7 +806,7 @@ verify_crt(gnutls_x509_crt_t cert,
|
||||
}
|
||||
|
||||
if (sigalg >= 0 && se) {
|
||||
- if (is_level_acceptable(cert, issuer, sigalg, flags) == 0) {
|
||||
+ if (is_level_acceptable(cert, issuer, sigalg, false, flags) == 0) {
|
||||
MARK_INVALID(GNUTLS_CERT_INSECURE_ALGORITHM);
|
||||
}
|
||||
|
||||
@@ -893,7 +901,7 @@ unsigned check_ca_sanity(const gnutls_x509_crt_t issuer,
|
||||
|
||||
/* we explicitly allow CAs which we do not support their self-algorithms
|
||||
* to pass. */
|
||||
- if (ret >= 0 && !is_level_acceptable(issuer, NULL, sigalg, flags)) {
|
||||
+ if (ret >= 0 && !is_level_acceptable(issuer, NULL, sigalg, true, flags)) {
|
||||
status |= GNUTLS_CERT_INSECURE_ALGORITHM|GNUTLS_CERT_INVALID;
|
||||
}
|
||||
|
||||
diff --git a/tests/test-chains.h b/tests/test-chains.h
|
||||
index 9b06b85f5..64f50fabf 100644
|
||||
--- a/tests/test-chains.h
|
||||
+++ b/tests/test-chains.h
|
||||
@@ -4106,6 +4106,163 @@ static const char *superseding_ca[] = {
|
||||
NULL
|
||||
};
|
||||
|
||||
+static const char *rsa_sha1_in_trusted[] = {
|
||||
+ "-----BEGIN CERTIFICATE-----\n"
|
||||
+ "MIID0jCCAoqgAwIBAgIUezaBB7f4TW75oc3UV57oJvXmbBYwDQYJKoZIhvcNAQEL\n"
|
||||
+ "BQAwGTEXMBUGA1UEAxMOR251VExTIHRlc3QgQ0EwHhcNMjEwNTAzMTQyNzIxWhcN\n"
|
||||
+ "MjIwNTAzMTQyNzIxWjA3MRgwFgYDVQQDEw90ZXN0LmdudXRscy5vcmcxGzAZBgNV\n"
|
||||
+ "BAoTEkdudVRMUyB0ZXN0IHNlcnZlcjCCAVIwDQYJKoZIhvcNAQEBBQADggE/ADCC\n"
|
||||
+ "AToCggExALRrJ5glr8H/HsqwfvTYvO1DhmdUXdq0HsKQX4M8AhH8E3KFsoikZUEL\n"
|
||||
+ "dl8jvoqf/nlLczsux0s8vxbJl1U1F/OhckswwuAnlBLzVgDmzoJLEV2kHpv6+rkb\n"
|
||||
+ "Kk0Ytbql5gzHqKihbaqIhNyWDrJsHDWq58eUPfnVx8KiDUuzbnr3CF/FCc0Vkxr3\n"
|
||||
+ "mN8qTGaJJO0f0BZjgWWlWDuhzSVim5mBVAgXGOx8LwiiOyhXMp0XRwqG+2KxQZnm\n"
|
||||
+ "+96o6iB+8xvuuuqaIWQpkvKtc+UZBZ03U+IRnxhfIrriiw0AjJ4vp4c9QL5KoqWS\n"
|
||||
+ "CAwuYcBYfJqZ4dasgzklzz4b7eujbZ3LxTjewcdumzQUvjA+gpAeuUqaduTvMwxG\n"
|
||||
+ "ojFy9sNhC/iqZ4n0peV2N6Epn4B5qnUCAwEAAaOBkzCBkDAMBgNVHRMBAf8EAjAA\n"
|
||||
+ "MBoGA1UdEQQTMBGCD3Rlc3QuZ251dGxzLm9yZzATBgNVHSUEDDAKBggrBgEFBQcD\n"
|
||||
+ "ATAPBgNVHQ8BAf8EBQMDB6AAMB0GA1UdDgQWBBRIIzRTCokxOEpa6sq20qbezh0r\n"
|
||||
+ "GDAfBgNVHSMEGDAWgBQedyNtZzEfkQebli/s/MhG/ozhAzANBgkqhkiG9w0BAQsF\n"
|
||||
+ "AAOCATEAXs8lOV231HQerhSGEjZJz0vBuA3biKYlu3cwCTKvF6EOyYMSWOnfqqD0\n"
|
||||
+ "eDhpo1pzGtUa2zYLHagb+sU2NSTe0sqP+PK1giUg8X8/tRtWKk1p/m76yK/3iaty\n"
|
||||
+ "flgz+eMai4xQu2FvAJzIASFjM9R+Pgpcf/zdvkiUPv8Rdm9FieyAZnJSo9hJHLxN\n"
|
||||
+ "x60tfC5yyswdbGGW0GbJ2kr+xMfVZvxgO/x6AXlOaUGQ+jZAu9eJwFQMDW5h5/S1\n"
|
||||
+ "PJkIt7f7jkU33cG+BawcjhT0GzxuvDnnCG0L7/z7bR+Sw2kNKqHbHorzv91R20Oh\n"
|
||||
+ "CIISJPkiiP+mYcglTp1d9gw09GwSkGbldb9ibfc0hKyxiImFfIiTqDbXJcpKH98o\n"
|
||||
+ "W8hWkb20QURlY+QM5MD49znfhPKMTQ==\n"
|
||||
+ "-----END CERTIFICATE-----\n",
|
||||
+ "-----BEGIN CERTIFICATE-----\n"
|
||||
+ "MIID2TCCAkGgAwIBAgIUWsb4DATcefXbo0WrBfgqVMvPGawwDQYJKoZIhvcNAQEL\n"
|
||||
+ "BQAwHjEcMBoGA1UEAxMTR251VExTIHRlc3Qgcm9vdCBDQTAeFw0yMTA1MDMxNDI2\n"
|
||||
+ "MzVaFw0yMjA1MDMxNDI2MzVaMBkxFzAVBgNVBAMTDkdudVRMUyB0ZXN0IENBMIIB\n"
|
||||
+ "UjANBgkqhkiG9w0BAQEFAAOCAT8AMIIBOgKCATEAnORCsX1unl//fy2d1054XduI\n"
|
||||
+ "g/3CqVBaT3Hca65SEoDwh0KiPtQoOgZLdKY2cobGs/ojYtOjcs0KnlPYdmtjEh6W\n"
|
||||
+ "EhuJU95v4TQdC4OLMiE56eIGq252hZAbHoTL84Q14DxQWGuzQK830iml7fbw2WcI\n"
|
||||
+ "cRQ8vFGs8SzfXw63+MI6Fq6iMAQIqP08WzGmRRzL5wvCiPhCVkrPmwbXoABub6AA\n"
|
||||
+ "sYwWPJB91M9/lx5gFH5k9/iPfi3s2Kg3F8MOcppqFYjxDSnsfiz6eMh1+bYVIAo3\n"
|
||||
+ "67vGVYHigXMEZC2FezlwIHaZzpEoFlY3a7LFJ00yrjQ910r8UE+CEMTYzE40D0ol\n"
|
||||
+ "CMo7FA9RCjeO3bUIoYaIdVTUGWEGHWSeoxGei9Gkm6u+ASj8f+i0jxdD2qXsewID\n"
|
||||
+ "AQABo2QwYjAPBgNVHRMBAf8EBTADAQH/MA8GA1UdDwEB/wQFAwMHBAAwHQYDVR0O\n"
|
||||
+ "BBYEFB53I21nMR+RB5uWL+z8yEb+jOEDMB8GA1UdIwQYMBaAFCApU0Q1pxZL+AW3\n"
|
||||
+ "GctysPWxl+SfMA0GCSqGSIb3DQEBCwUAA4IBgQBbboeDr/rLT1tZWrdHq8FvflGm\n"
|
||||
+ "EpxZIRU4DdDD/SUCWSPQvjBq0MvuKxs5FfJCKrDf2kS2qlZ1rO0AuWwREoDeTOEc\n"
|
||||
+ "arjFoCry+JQ+USqS5F4gsp4XlYvli27iMp3dlnhFXEQQy7/y+gM5c9wnMi8v/LUz\n"
|
||||
+ "AV6QHX0fkb4XeazeJ+Nq0EkjqiYxylN6mP+5LAEMBG/wGviAoviQ5tN9zdoQs/nT\n"
|
||||
+ "3jTw3cOauuPjdcOTfo71+/MtBzhPchgNIyQo4aB40XVWsLAoruL/3CFFlTniihtd\n"
|
||||
+ "zA2zA7JvbuuKx6BOv2IbWOUweb732ZpYbDgEcXp/6Cj/SIUGxidpEgdCJGqyqdC7\n"
|
||||
+ "b58ujxclC6QTcicw+SX5LBox8WGLfj+x+V3uVBz9+EK608xphTj4kLh9peII9v3n\n"
|
||||
+ "vBUoZRTiUTCvH4AJJgAfa3mYrSxzueuqBOwXcvZ+8OJ0J1CP21pmK5nxR7f1nm9Q\n"
|
||||
+ "sYA1VHfC2dtyAYlByeF5iHl5hFR6vy1jJyzxg2M=\n"
|
||||
+ "-----END CERTIFICATE-----\n",
|
||||
+ NULL
|
||||
+};
|
||||
+
|
||||
+static const char *rsa_sha1_in_trusted_ca[] = {
|
||||
+ /* This CA is generated with the same key as rsa_sha1_in_trusted[1], but
|
||||
+ * self-signed using SHA-1.
|
||||
+ */
|
||||
+ "-----BEGIN CERTIFICATE-----\n"
|
||||
+ "MIIDYzCCAhugAwIBAgIUahO8CvYPHTAltKCC2rAIcXUiLlAwDQYJKoZIhvcNAQEF\n"
|
||||
+ "BQAwGTEXMBUGA1UEAxMOR251VExTIHRlc3QgQ0EwHhcNMjEwNTAzMTQyMDM1WhcN\n"
|
||||
+ "MjIwNTAzMTQyMDM1WjAZMRcwFQYDVQQDEw5HbnVUTFMgdGVzdCBDQTCCAVIwDQYJ\n"
|
||||
+ "KoZIhvcNAQEBBQADggE/ADCCAToCggExAJzkQrF9bp5f/38tnddOeF3biIP9wqlQ\n"
|
||||
+ "Wk9x3GuuUhKA8IdCoj7UKDoGS3SmNnKGxrP6I2LTo3LNCp5T2HZrYxIelhIbiVPe\n"
|
||||
+ "b+E0HQuDizIhOeniBqtudoWQGx6Ey/OENeA8UFhrs0CvN9Ippe328NlnCHEUPLxR\n"
|
||||
+ "rPEs318Ot/jCOhauojAECKj9PFsxpkUcy+cLwoj4QlZKz5sG16AAbm+gALGMFjyQ\n"
|
||||
+ "fdTPf5ceYBR+ZPf4j34t7NioNxfDDnKaahWI8Q0p7H4s+njIdfm2FSAKN+u7xlWB\n"
|
||||
+ "4oFzBGQthXs5cCB2mc6RKBZWN2uyxSdNMq40PddK/FBPghDE2MxONA9KJQjKOxQP\n"
|
||||
+ "UQo3jt21CKGGiHVU1BlhBh1knqMRnovRpJurvgEo/H/otI8XQ9ql7HsCAwEAAaND\n"
|
||||
+ "MEEwDwYDVR0TAQH/BAUwAwEB/zAPBgNVHQ8BAf8EBQMDBwQAMB0GA1UdDgQWBBQe\n"
|
||||
+ "dyNtZzEfkQebli/s/MhG/ozhAzANBgkqhkiG9w0BAQUFAAOCATEAYLm/4DfUp+mA\n"
|
||||
+ "S/23a2bwybJoPCMzKZpi+veXkqoq/a/BCUkFpqnjpVjz0ujVKK121oeOPBAa/mG1\n"
|
||||
+ "Y3fJYP+b3PloL/6xj/8680TveGirCr0Rp/8XWa8lt+Ge8DM3mfTGWFTWHa0lD9VK\n"
|
||||
+ "gjV1oNZNLe5SKA6dJLAp/NjCxc/vuOkThQPeaoO5Iy/Z6m7CpTLO7T4syJFtDmSn\n"
|
||||
+ "Pa/yFUDTgJYFlGVM+KC1r8bhZ6Ao1CAXTcT5Lcbe/aCcyk6B3J2AnYsqPMVNEVhb\n"
|
||||
+ "9eMGO/WG24hMLy6eb1r/yL8uQ/uGi2rRlNJN8GTg09YR7l5fHrHxuHc/sme0jsnJ\n"
|
||||
+ "wtqGLCJsrh7Ae1fKVUueO00Yx9BGuzLswMvnT5f0oYs0jrXgMrTbIWS/DjOcYIHb\n"
|
||||
+ "w3SV1ZRcNg==\n"
|
||||
+ "-----END CERTIFICATE-----\n",
|
||||
+ NULL
|
||||
+};
|
||||
+
|
||||
+static const char *rsa_sha1_not_in_trusted[] = {
|
||||
+ "-----BEGIN CERTIFICATE-----\n"
|
||||
+ "MIID0jCCAoqgAwIBAgIUNCvPV9OvyuVMtnkC3ZAvh959h4MwDQYJKoZIhvcNAQEL\n"
|
||||
+ "BQAwGTEXMBUGA1UEAxMOR251VExTIHRlc3QgQ0EwHhcNMjEwNTA0MDg0NzAzWhcN\n"
|
||||
+ "MjIwNTA0MDg0NzAzWjA3MRgwFgYDVQQDEw90ZXN0LmdudXRscy5vcmcxGzAZBgNV\n"
|
||||
+ "BAoTEkdudVRMUyB0ZXN0IHNlcnZlcjCCAVIwDQYJKoZIhvcNAQEBBQADggE/ADCC\n"
|
||||
+ "AToCggExALRrJ5glr8H/HsqwfvTYvO1DhmdUXdq0HsKQX4M8AhH8E3KFsoikZUEL\n"
|
||||
+ "dl8jvoqf/nlLczsux0s8vxbJl1U1F/OhckswwuAnlBLzVgDmzoJLEV2kHpv6+rkb\n"
|
||||
+ "Kk0Ytbql5gzHqKihbaqIhNyWDrJsHDWq58eUPfnVx8KiDUuzbnr3CF/FCc0Vkxr3\n"
|
||||
+ "mN8qTGaJJO0f0BZjgWWlWDuhzSVim5mBVAgXGOx8LwiiOyhXMp0XRwqG+2KxQZnm\n"
|
||||
+ "+96o6iB+8xvuuuqaIWQpkvKtc+UZBZ03U+IRnxhfIrriiw0AjJ4vp4c9QL5KoqWS\n"
|
||||
+ "CAwuYcBYfJqZ4dasgzklzz4b7eujbZ3LxTjewcdumzQUvjA+gpAeuUqaduTvMwxG\n"
|
||||
+ "ojFy9sNhC/iqZ4n0peV2N6Epn4B5qnUCAwEAAaOBkzCBkDAMBgNVHRMBAf8EAjAA\n"
|
||||
+ "MBoGA1UdEQQTMBGCD3Rlc3QuZ251dGxzLm9yZzATBgNVHSUEDDAKBggrBgEFBQcD\n"
|
||||
+ "ATAPBgNVHQ8BAf8EBQMDB6AAMB0GA1UdDgQWBBRIIzRTCokxOEpa6sq20qbezh0r\n"
|
||||
+ "GDAfBgNVHSMEGDAWgBQedyNtZzEfkQebli/s/MhG/ozhAzANBgkqhkiG9w0BAQsF\n"
|
||||
+ "AAOCATEAWs/Qa1Ebydwo4Ke2KEdy5cUTSZjnoz93XpbrP9W60MJ4d2DIQPcYUcLF\n"
|
||||
+ "+glez+mRtVXDRtH5V/4yZX1EdgrPVQGeVlO5HbNiYyYw/Yj3H6kzWtUbBxdOAOE/\n"
|
||||
+ "/ul8RCKKMfvYBHCBgjBMW0aFm31Q1Z8m8nanBusyJ0DG1scBHu4/3vTCZthZAxc5\n"
|
||||
+ "3l3t/jjsNRS+k5t6Ay8nEY1tAZSGVqN8qufzO2NBO06sQagp09FTfDh581OBcVtF\n"
|
||||
+ "X7O0cffAWHk3JoywzEWFEAhVPqFlk07wG2O+k+fYZfavsJko5q+yWkxu8RDh4wAx\n"
|
||||
+ "7UzKudGOQ+NhfYJ7N7V1/RFg1z75gE3GTUX7qmGZEVDOsMyiuUeYg8znyYpBV55Q\n"
|
||||
+ "4BNr0ukwmwOdvUf+ksCu6PdOGaqThA==\n"
|
||||
+ "-----END CERTIFICATE-----\n",
|
||||
+ /* ICA with SHA1 signature */
|
||||
+ "-----BEGIN CERTIFICATE-----\n"
|
||||
+ "MIID2TCCAkGgAwIBAgIUYaKJkQft87M1TF+Jd30py3yIq4swDQYJKoZIhvcNAQEF\n"
|
||||
+ "BQAwHjEcMBoGA1UEAxMTR251VExTIHRlc3Qgcm9vdCBDQTAeFw0yMTA1MDQwODQ1\n"
|
||||
+ "NDdaFw0yMjA1MDQwODQ1NDdaMBkxFzAVBgNVBAMTDkdudVRMUyB0ZXN0IENBMIIB\n"
|
||||
+ "UjANBgkqhkiG9w0BAQEFAAOCAT8AMIIBOgKCATEAnORCsX1unl//fy2d1054XduI\n"
|
||||
+ "g/3CqVBaT3Hca65SEoDwh0KiPtQoOgZLdKY2cobGs/ojYtOjcs0KnlPYdmtjEh6W\n"
|
||||
+ "EhuJU95v4TQdC4OLMiE56eIGq252hZAbHoTL84Q14DxQWGuzQK830iml7fbw2WcI\n"
|
||||
+ "cRQ8vFGs8SzfXw63+MI6Fq6iMAQIqP08WzGmRRzL5wvCiPhCVkrPmwbXoABub6AA\n"
|
||||
+ "sYwWPJB91M9/lx5gFH5k9/iPfi3s2Kg3F8MOcppqFYjxDSnsfiz6eMh1+bYVIAo3\n"
|
||||
+ "67vGVYHigXMEZC2FezlwIHaZzpEoFlY3a7LFJ00yrjQ910r8UE+CEMTYzE40D0ol\n"
|
||||
+ "CMo7FA9RCjeO3bUIoYaIdVTUGWEGHWSeoxGei9Gkm6u+ASj8f+i0jxdD2qXsewID\n"
|
||||
+ "AQABo2QwYjAPBgNVHRMBAf8EBTADAQH/MA8GA1UdDwEB/wQFAwMHBAAwHQYDVR0O\n"
|
||||
+ "BBYEFB53I21nMR+RB5uWL+z8yEb+jOEDMB8GA1UdIwQYMBaAFCApU0Q1pxZL+AW3\n"
|
||||
+ "GctysPWxl+SfMA0GCSqGSIb3DQEBBQUAA4IBgQAewBcAGUGX28I5PDtuJkxoHonD\n"
|
||||
+ "muHdXpYnrz1YXN4b7odNXockz++Xovgj126fo+PeWgmaaCic98ZcGnyVTi9+3oqN\n"
|
||||
+ "2Bf4NNfyzSccgZZTphzbwjMcnc983HLQgsLSAOVivPHj5GEN58EWWamc9yA0VjGn\n"
|
||||
+ "cuYmFN2dlFA8/ClEbVGu3UXBe6OljR5zUr+6oiSp2J+Rl7SerVSHlst07iU2tkeB\n"
|
||||
+ "dlfOD5CquUGSka3SKvEfvu5SwYrCQVfYB6eMLInm7A0/ca0Jn3Oh4fMf2rIg/E3K\n"
|
||||
+ "qsopxsu8BXrLoGK4MxbxPA65JpczhZgilQQi3e3RIvxrvyD2qamjaNbyG5cr8mW4\n"
|
||||
+ "VOLf3vUORbkTi5sE7uRMu2B3z3N7ajsuQM8RHB17hOCB2FO/8rermq/oeJNtx57L\n"
|
||||
+ "5s5NxCHYTksQ4gkpR4gfTIO/zwXJSwGa/Zi2y2wIi/1qr7lppBsKV2rDWX7QiIeA\n"
|
||||
+ "PxOxyJA2eSeqCorz9vk3aHXleSpxsWGgKiJVmV0=\n"
|
||||
+ "-----END CERTIFICATE-----\n",
|
||||
+ NULL
|
||||
+};
|
||||
+
|
||||
+static const char *rsa_sha1_not_in_trusted_ca[] = {
|
||||
+ "-----BEGIN CERTIFICATE-----\n"
|
||||
+ "MIIEDTCCAnWgAwIBAgIUd5X8NZput+aNPEd9h92r4KAu16MwDQYJKoZIhvcNAQEL\n"
|
||||
+ "BQAwHjEcMBoGA1UEAxMTR251VExTIHRlc3Qgcm9vdCBDQTAeFw0yMTA1MDMxNDI1\n"
|
||||
+ "MDNaFw0yMjA1MDMxNDI1MDNaMB4xHDAaBgNVBAMTE0dudVRMUyB0ZXN0IHJvb3Qg\n"
|
||||
+ "Q0EwggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQCsFAaMb/iRN+OFqQNh\n"
|
||||
+ "OkkXGZlb+eLerLuB9ELnYwyLIh4MTXh0RjFZdCQLsQHfY/YFv0C50rmoXTA/d3Ef\n"
|
||||
+ "K/P243KjX0XBWjO9TBuN0zth50eq94zf69yxA/a+kmT+O5YLfhi2ELM5F3IjOUoZ\n"
|
||||
+ "lL0IGlFJwauAkaNylp/Evd5nW7g5DUJvMm4A3RXNfZt9gAD4lPRwryQq9jxT48Xu\n"
|
||||
+ "fB0kAPEG/l/Izbz2rYin5+nySL+a0CSNuEbITxidtMhveB747oR0QS2sMQKji1ur\n"
|
||||
+ "pRJ945SHiYJIgVuFAJc9StikSyIrxZgK45kAzcQAyRWWKiMNH5PprGFYJp+ypwhm\n"
|
||||
+ "1t8Bphj2RFJAG3XRRZF/9uJIYc5mEHCsZFZ/IFRaKqyN30kAUijgNt+lW5mZXVFU\n"
|
||||
+ "aqzV2zHjSG8jsGdia3cfBP46Z1q2eAh5jOCucTq1F7qZdVhOFmP9jFE6Uy5Kbwgc\n"
|
||||
+ "kNAnsEllQeJQL2odVa7woKkZZ4M/c72X5tpBU38Rs3krn3sCAwEAAaNDMEEwDwYD\n"
|
||||
+ "VR0TAQH/BAUwAwEB/zAPBgNVHQ8BAf8EBQMDBwQAMB0GA1UdDgQWBBQgKVNENacW\n"
|
||||
+ "S/gFtxnLcrD1sZfknzANBgkqhkiG9w0BAQsFAAOCAYEAaZMV71mZ9FYoVdpho61h\n"
|
||||
+ "WWPs5GppQLJ1w70DNtGZ+lFrk/KopeDvOu1i61QLWRzcZCZMl+npiX1KH5kjVo3v\n"
|
||||
+ "C9G8kdMW6EVRk5p6qCJMPFN2U+grMMp50aY5kmw+/v+Lhk5T/VG93l63P91FkUre\n"
|
||||
+ "o8qhOudJExoUnR1uB9M6HMAxVn8Lm/N1LGPiP6A6Pboo716H7mg/A7pv9zoZ6jUp\n"
|
||||
+ "7x693mA/b3I/QpDx/nJcmcdqxgEuW+aRlFXgnYZRFAawxi+5M9EwCWbkSTO4OMHP\n"
|
||||
+ "Qlvak3tJO+wb92b0cICOOtzIPgQ+caiLg9d0FvesALmQzDmNmtqynoO85+Ia2Ywh\n"
|
||||
+ "nxKPlpeImhLN9nGl9sOeW2m4mnA5r0h1vgML4v/MWL4TQhXallc31uFNj5HyFaTh\n"
|
||||
+ "6Mr0g3GeQgN0jpT+aIOiKuW9fLts54+Ntj1NN40slqi3Y+/Yd6xhj+NgmbRvybZu\n"
|
||||
+ "tnYFXKC0Q+QUf38horqG2Mc3/uh8MOm0eYUXwGJOdXYD\n"
|
||||
+ "-----END CERTIFICATE-----\n",
|
||||
+ NULL
|
||||
+};
|
||||
+
|
||||
#if defined __clang__ || __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 5)
|
||||
# pragma GCC diagnostic push
|
||||
# pragma GCC diagnostic ignored "-Wunused-variable"
|
||||
@@ -4275,6 +4432,14 @@ static struct
|
||||
{ "ed448 - ok", ed448, &ed448[0], GNUTLS_PROFILE_TO_VFLAGS(GNUTLS_PROFILE_ULTRA),
|
||||
0, NULL, 1584352960, 1},
|
||||
{ "superseding - ok", superseding, superseding_ca, 0, 0, 0, 1590928011 },
|
||||
+ { "rsa-sha1 in trusted - ok",
|
||||
+ rsa_sha1_in_trusted, rsa_sha1_in_trusted_ca,
|
||||
+ GNUTLS_PROFILE_TO_VFLAGS(GNUTLS_PROFILE_MEDIUM),
|
||||
+ 0, NULL, 1620052390, 1},
|
||||
+ { "rsa-sha1 not in trusted - not ok",
|
||||
+ rsa_sha1_not_in_trusted, rsa_sha1_not_in_trusted_ca,
|
||||
+ GNUTLS_PROFILE_TO_VFLAGS(GNUTLS_PROFILE_MEDIUM),
|
||||
+ GNUTLS_CERT_INSECURE_ALGORITHM | GNUTLS_CERT_INVALID, NULL, 1620118136, 1},
|
||||
{ NULL, NULL, NULL, 0, 0}
|
||||
};
|
||||
|
||||
--
|
||||
2.31.1
|
||||
|
|
@ -1,6 +1,8 @@
|
|||
--- a/guile/src/Makefile.in 2019-03-27 11:51:55.984398001 +0100
|
||||
+++ b/guile/src/Makefile.in 2019-03-27 11:52:27.259626076 +0100
|
||||
@@ -1472,7 +1472,7 @@
|
||||
diff --git a/guile/src/Makefile.in b/guile/src/Makefile.in
|
||||
index 95e1e9c..1dfc88e 100644
|
||||
--- a/guile/src/Makefile.in
|
||||
+++ b/guile/src/Makefile.in
|
||||
@@ -1483,7 +1483,7 @@ guileextension_LTLIBRARIES = guile-gnutls-v-2.la
|
||||
# Use '-module' to build a "dlopenable module", in Libtool terms.
|
||||
# Use '-undefined' to placate Libtool on Windows; see
|
||||
# <https://lists.gnutls.org/pipermail/gnutls-devel/2014-December/007294.html>.
|
File diff suppressed because it is too large
Load Diff
|
@ -1,32 +0,0 @@
|
|||
From 36a92d984020df16296784a7ad613c9693469d23 Mon Sep 17 00:00:00 2001
|
||||
From: rpm-build <rpm-build>
|
||||
Date: Tue, 21 Dec 2021 16:28:09 +0100
|
||||
Subject: [PATCH 1/2] Remove GNUTLS_NO_EXPLICIT_INIT compatibility
|
||||
|
||||
Signed-off-by: rpm-build <rpm-build>
|
||||
---
|
||||
lib/global.c | 8 --------
|
||||
1 file changed, 8 deletions(-)
|
||||
|
||||
diff --git a/lib/global.c b/lib/global.c
|
||||
index 3731418..1384045 100644
|
||||
--- a/lib/global.c
|
||||
+++ b/lib/global.c
|
||||
@@ -500,14 +500,6 @@ static void _CONSTRUCTOR lib_init(void)
|
||||
return;
|
||||
}
|
||||
|
||||
- e = secure_getenv("GNUTLS_NO_EXPLICIT_INIT");
|
||||
- if (e != NULL) {
|
||||
- _gnutls_debug_log("GNUTLS_NO_EXPLICIT_INIT is deprecated; use GNUTLS_NO_IMPLICIT_INIT\n");
|
||||
- ret = atoi(e);
|
||||
- if (ret == 1)
|
||||
- return;
|
||||
- }
|
||||
-
|
||||
ret = _gnutls_global_init(1);
|
||||
if (ret < 0) {
|
||||
fprintf(stderr, "Error in GnuTLS initialization: %s\n", gnutls_strerror(ret));
|
||||
--
|
||||
2.31.1
|
||||
|
|
@ -1,26 +0,0 @@
|
|||
diff --git a/lib/priority.c b/lib/priority.c
|
||||
index 9feec47fe2..40511710fd 100644
|
||||
--- a/lib/priority.c
|
||||
+++ b/lib/priority.c
|
||||
@@ -2001,13 +2001,14 @@ char *_gnutls_resolve_priorities(const char* priorities)
|
||||
additional++;
|
||||
}
|
||||
|
||||
- /* Always try to refresh the cached data, to allow it to be
|
||||
- * updated without restarting all applications.
|
||||
- */
|
||||
- ret = _gnutls_update_system_priorities(false /* defer_system_wide */);
|
||||
- if (ret < 0) {
|
||||
- _gnutls_debug_log("failed to update system priorities: %s\n",
|
||||
- gnutls_strerror(ret));
|
||||
+ /* If priority string is not constructed yet, construct and finalize */
|
||||
+ if (!system_wide_config.priority_string) {
|
||||
+ ret = _gnutls_update_system_priorities(false
|
||||
+ /* defer_system_wide */);
|
||||
+ if (ret < 0) {
|
||||
+ _gnutls_debug_log("failed to update system priorities: "
|
||||
+ " %s\n", gnutls_strerror(ret));
|
||||
+ }
|
||||
}
|
||||
|
||||
do {
|
|
@ -1,29 +0,0 @@
|
|||
From 0a29639ad24072afbd79b2ceede9976e51b9e2af Mon Sep 17 00:00:00 2001
|
||||
From: rpm-build <rpm-build>
|
||||
Date: Fri, 1 Jul 2022 16:46:07 +0900
|
||||
Subject: [PATCH] fips: don't run POST for DSA
|
||||
|
||||
Signed-off-by: rpm-build <<rpm-build>>
|
||||
---
|
||||
lib/fips.c | 5 -----
|
||||
1 file changed, 5 deletions(-)
|
||||
|
||||
diff --git a/lib/fips.c b/lib/fips.c
|
||||
index 656d43e..c776690 100644
|
||||
--- a/lib/fips.c
|
||||
+++ b/lib/fips.c
|
||||
@@ -523,11 +523,6 @@ int _gnutls_fips_perform_self_checks2(void)
|
||||
return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
}
|
||||
|
||||
- ret = gnutls_pk_self_test(0, GNUTLS_PK_DSA);
|
||||
- if (ret < 0) {
|
||||
- return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
- }
|
||||
-
|
||||
ret = gnutls_pk_self_test(0, GNUTLS_PK_EC);
|
||||
if (ret < 0) {
|
||||
return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
--
|
||||
2.36.1
|
||||
|
|
@ -1,720 +0,0 @@
|
|||
From 2f61f102169e4d6652c9b82246353cd276366809 Mon Sep 17 00:00:00 2001
|
||||
From: Daiki Ueno <ueno@gnu.org>
|
||||
Date: Mon, 27 Jun 2022 11:14:50 +0900
|
||||
Subject: [PATCH] cipher: limit plaintext length supplied to AES-GCM
|
||||
|
||||
According to SP800-38D 5.2.1.1, input data length of AES-GCM
|
||||
encryption function must be less than or equal to 2^39-256 bits.
|
||||
|
||||
Signed-off-by: Daiki Ueno <ueno@gnu.org>
|
||||
---
|
||||
NEWS | 3 +
|
||||
lib/accelerated/aarch64/aes-aarch64.h | 15 ++++
|
||||
lib/accelerated/aarch64/aes-gcm-aarch64.c | 9 +++
|
||||
lib/accelerated/x86/aes-gcm-padlock.c | 29 ++++---
|
||||
lib/accelerated/x86/aes-gcm-x86-aesni.c | 30 +++++---
|
||||
lib/accelerated/x86/aes-gcm-x86-pclmul-avx.c | 9 +++
|
||||
lib/accelerated/x86/aes-gcm-x86-pclmul.c | 9 +++
|
||||
lib/accelerated/x86/aes-gcm-x86-ssse3.c | 30 +++++---
|
||||
lib/accelerated/x86/aes-x86.h | 15 ++++
|
||||
lib/nettle/cipher.c | 41 ++++++++++
|
||||
tests/slow/cipher-api-test.c | 79 ++++++++++++++++++++
|
||||
11 files changed, 240 insertions(+), 29 deletions(-)
|
||||
|
||||
diff --git a/lib/accelerated/aarch64/aes-aarch64.h b/lib/accelerated/aarch64/aes-aarch64.h
|
||||
index 692d8620d7..0e64f4ed8d 100644
|
||||
--- a/lib/accelerated/aarch64/aes-aarch64.h
|
||||
+++ b/lib/accelerated/aarch64/aes-aarch64.h
|
||||
@@ -20,6 +20,21 @@ typedef struct {
|
||||
if (s != 16 && s != 24 && s != 32) \
|
||||
return GNUTLS_E_INVALID_REQUEST
|
||||
|
||||
+#include <intprops.h>
|
||||
+#define AES_GCM_ENCRYPT_MAX_BYTES ((1ULL << 36) - 32)
|
||||
+static inline int
|
||||
+record_aes_gcm_encrypt_size(size_t *counter, size_t size) {
|
||||
+ size_t sum;
|
||||
+
|
||||
+ if (!INT_ADD_OK(*counter, size, &sum) ||
|
||||
+ sum > AES_GCM_ENCRYPT_MAX_BYTES) {
|
||||
+ return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
|
||||
+ }
|
||||
+ *counter = sum;
|
||||
+
|
||||
+ return 0;
|
||||
+}
|
||||
+
|
||||
int aes_v8_set_encrypt_key(const unsigned char *userKey, int bits, AES_KEY *key);
|
||||
int aes_v8_set_decrypt_key(const unsigned char *userKey, int bits, AES_KEY *key);
|
||||
void aes_v8_cbc_encrypt(const unsigned char *in, unsigned char *out,
|
||||
diff --git a/lib/accelerated/aarch64/aes-gcm-aarch64.c b/lib/accelerated/aarch64/aes-gcm-aarch64.c
|
||||
index 901bd9f60f..be1e69c784 100644
|
||||
--- a/lib/accelerated/aarch64/aes-gcm-aarch64.c
|
||||
+++ b/lib/accelerated/aarch64/aes-gcm-aarch64.c
|
||||
@@ -62,6 +62,7 @@ struct aes_gcm_ctx {
|
||||
struct gcm128_context gcm;
|
||||
unsigned finished;
|
||||
unsigned auth_finished;
|
||||
+ size_t rekey_counter;
|
||||
};
|
||||
|
||||
void gcm_init_v8(u128 Htable[16], const uint64_t Xi[2]);
|
||||
@@ -116,6 +117,7 @@ aes_gcm_cipher_setkey(void *_ctx, const void *userkey, size_t keysize)
|
||||
ctx->gcm.H.u[1] = bswap_64(ctx->gcm.H.u[1]);
|
||||
|
||||
gcm_init_v8(ctx->gcm.Htable, ctx->gcm.H.u);
|
||||
+ ctx->rekey_counter = 0;
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -141,6 +143,7 @@ static int aes_gcm_setiv(void *_ctx, const void *iv, size_t iv_size)
|
||||
ctx->gcm.Yi.c[GCM_BLOCK_SIZE - 1] = 2;
|
||||
ctx->finished = 0;
|
||||
ctx->auth_finished = 0;
|
||||
+ ctx->rekey_counter = 0;
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -229,6 +232,7 @@ aes_gcm_encrypt(void *_ctx, const void *src, size_t src_size,
|
||||
int exp_blocks = blocks * GCM_BLOCK_SIZE;
|
||||
int rest = src_size - (exp_blocks);
|
||||
uint32_t counter;
|
||||
+ int ret;
|
||||
|
||||
if (unlikely(ctx->finished))
|
||||
return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
|
||||
@@ -236,6 +240,11 @@ aes_gcm_encrypt(void *_ctx, const void *src, size_t src_size,
|
||||
if (unlikely(length < src_size))
|
||||
return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
|
||||
|
||||
+ ret = record_aes_gcm_encrypt_size(&ctx->rekey_counter, src_size);
|
||||
+ if (ret < 0) {
|
||||
+ return gnutls_assert_val(ret);
|
||||
+ }
|
||||
+
|
||||
if (blocks > 0) {
|
||||
ctr32_encrypt_blocks(src, dst,
|
||||
blocks,
|
||||
diff --git a/lib/accelerated/x86/aes-gcm-padlock.c b/lib/accelerated/x86/aes-gcm-padlock.c
|
||||
index a9c7441d65..739883ab1b 100644
|
||||
--- a/lib/accelerated/x86/aes-gcm-padlock.c
|
||||
+++ b/lib/accelerated/x86/aes-gcm-padlock.c
|
||||
@@ -43,7 +43,10 @@
|
||||
* Actually padlock doesn't include GCM mode. We just use
|
||||
* the ECB part of padlock and nettle for everything else.
|
||||
*/
|
||||
-struct gcm_padlock_aes_ctx GCM_CTX(struct padlock_ctx);
|
||||
+struct gcm_padlock_aes_ctx {
|
||||
+ struct GCM_CTX(struct padlock_ctx) inner;
|
||||
+ size_t rekey_counter;
|
||||
+};
|
||||
|
||||
static void padlock_aes_encrypt(const void *_ctx,
|
||||
size_t length, uint8_t * dst,
|
||||
@@ -78,7 +81,7 @@ static void padlock_aes256_set_encrypt_key(struct padlock_ctx *_ctx,
|
||||
|
||||
static void aes_gcm_deinit(void *_ctx)
|
||||
{
|
||||
- struct padlock_ctx *ctx = _ctx;
|
||||
+ struct gcm_padlock_aes_ctx *ctx = _ctx;
|
||||
|
||||
zeroize_temp_key(ctx, sizeof(*ctx));
|
||||
gnutls_free(ctx);
|
||||
@@ -108,14 +111,15 @@ aes_gcm_cipher_setkey(void *_ctx, const void *key, size_t keysize)
|
||||
struct gcm_padlock_aes_ctx *ctx = _ctx;
|
||||
|
||||
if (keysize == 16) {
|
||||
- GCM_SET_KEY(ctx, padlock_aes128_set_encrypt_key, padlock_aes_encrypt,
|
||||
+ GCM_SET_KEY(&ctx->inner, padlock_aes128_set_encrypt_key, padlock_aes_encrypt,
|
||||
key);
|
||||
} else if (keysize == 32) {
|
||||
- GCM_SET_KEY(ctx, padlock_aes256_set_encrypt_key, padlock_aes_encrypt,
|
||||
+ GCM_SET_KEY(&ctx->inner, padlock_aes256_set_encrypt_key, padlock_aes_encrypt,
|
||||
key);
|
||||
} else
|
||||
return GNUTLS_E_INVALID_REQUEST;
|
||||
|
||||
+ ctx->rekey_counter = 0;
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -126,8 +130,9 @@ static int aes_gcm_setiv(void *_ctx, const void *iv, size_t iv_size)
|
||||
if (iv_size != GCM_BLOCK_SIZE - 4)
|
||||
return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
|
||||
|
||||
- GCM_SET_IV(ctx, iv_size, iv);
|
||||
+ GCM_SET_IV(&ctx->inner, iv_size, iv);
|
||||
|
||||
+ ctx->rekey_counter = 0;
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -136,11 +141,17 @@ aes_gcm_encrypt(void *_ctx, const void *src, size_t src_size,
|
||||
void *dst, size_t length)
|
||||
{
|
||||
struct gcm_padlock_aes_ctx *ctx = _ctx;
|
||||
+ int ret;
|
||||
|
||||
if (unlikely(length < src_size))
|
||||
return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
|
||||
|
||||
- GCM_ENCRYPT(ctx, padlock_aes_encrypt, src_size, dst, src);
|
||||
+ ret = record_aes_gcm_encrypt_size(&ctx->rekey_counter, src_size);
|
||||
+ if (ret < 0) {
|
||||
+ return gnutls_assert_val(ret);
|
||||
+ }
|
||||
+
|
||||
+ GCM_ENCRYPT(&ctx->inner, padlock_aes_encrypt, src_size, dst, src);
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -154,7 +165,7 @@ aes_gcm_decrypt(void *_ctx, const void *src, size_t src_size,
|
||||
if (unlikely(dst_size < src_size))
|
||||
return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
|
||||
|
||||
- GCM_DECRYPT(ctx, padlock_aes_encrypt, src_size, dst, src);
|
||||
+ GCM_DECRYPT(&ctx->inner, padlock_aes_encrypt, src_size, dst, src);
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -162,7 +173,7 @@ static int aes_gcm_auth(void *_ctx, const void *src, size_t src_size)
|
||||
{
|
||||
struct gcm_padlock_aes_ctx *ctx = _ctx;
|
||||
|
||||
- GCM_UPDATE(ctx, src_size, src);
|
||||
+ GCM_UPDATE(&ctx->inner, src_size, src);
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -171,7 +182,7 @@ static void aes_gcm_tag(void *_ctx, void *tag, size_t tagsize)
|
||||
{
|
||||
struct gcm_padlock_aes_ctx *ctx = _ctx;
|
||||
|
||||
- GCM_DIGEST(ctx, padlock_aes_encrypt, tagsize, tag);
|
||||
+ GCM_DIGEST(&ctx->inner, padlock_aes_encrypt, tagsize, tag);
|
||||
}
|
||||
|
||||
#include "aes-gcm-aead.h"
|
||||
diff --git a/lib/accelerated/x86/aes-gcm-x86-aesni.c b/lib/accelerated/x86/aes-gcm-x86-aesni.c
|
||||
index b0edaebfba..3be63ddd97 100644
|
||||
--- a/lib/accelerated/x86/aes-gcm-x86-aesni.c
|
||||
+++ b/lib/accelerated/x86/aes-gcm-x86-aesni.c
|
||||
@@ -36,12 +36,14 @@
|
||||
#include <x86-common.h>
|
||||
#include <byteswap.h>
|
||||
#include <nettle/gcm.h>
|
||||
-#include <aes-x86.h>
|
||||
|
||||
/* GCM mode
|
||||
* It is used when the CPU doesn't include the PCLMUL instructions.
|
||||
*/
|
||||
-struct gcm_x86_aes_ctx GCM_CTX(AES_KEY);
|
||||
+struct gcm_x86_aes_ctx {
|
||||
+ struct GCM_CTX(AES_KEY) inner;
|
||||
+ size_t rekey_counter;
|
||||
+};
|
||||
|
||||
static void x86_aes_encrypt(const void *_ctx,
|
||||
size_t length, uint8_t * dst,
|
||||
@@ -101,17 +103,18 @@ aes_gcm_cipher_setkey(void *_ctx, const void *key, size_t length)
|
||||
struct gcm_x86_aes_ctx *ctx = _ctx;
|
||||
|
||||
if (length == 16) {
|
||||
- GCM_SET_KEY(ctx, x86_aes128_set_encrypt_key, x86_aes_encrypt,
|
||||
+ GCM_SET_KEY(&ctx->inner, x86_aes128_set_encrypt_key, x86_aes_encrypt,
|
||||
key);
|
||||
} else if (length == 24) {
|
||||
- GCM_SET_KEY(ctx, x86_aes192_set_encrypt_key, x86_aes_encrypt,
|
||||
+ GCM_SET_KEY(&ctx->inner, x86_aes192_set_encrypt_key, x86_aes_encrypt,
|
||||
key);
|
||||
} else if (length == 32) {
|
||||
- GCM_SET_KEY(ctx, x86_aes256_set_encrypt_key, x86_aes_encrypt,
|
||||
+ GCM_SET_KEY(&ctx->inner, x86_aes256_set_encrypt_key, x86_aes_encrypt,
|
||||
key);
|
||||
} else
|
||||
return GNUTLS_E_INVALID_REQUEST;
|
||||
|
||||
+ ctx->rekey_counter = 0;
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -122,8 +125,9 @@ static int aes_gcm_setiv(void *_ctx, const void *iv, size_t iv_size)
|
||||
if (iv_size != GCM_BLOCK_SIZE - 4)
|
||||
return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
|
||||
|
||||
- GCM_SET_IV(ctx, iv_size, iv);
|
||||
+ GCM_SET_IV(&ctx->inner, iv_size, iv);
|
||||
|
||||
+ ctx->rekey_counter = 0;
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -132,11 +136,17 @@ aes_gcm_encrypt(void *_ctx, const void *src, size_t src_size,
|
||||
void *dst, size_t length)
|
||||
{
|
||||
struct gcm_x86_aes_ctx *ctx = _ctx;
|
||||
+ int ret;
|
||||
|
||||
if (unlikely(length < src_size))
|
||||
return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
|
||||
|
||||
- GCM_ENCRYPT(ctx, x86_aes_encrypt, src_size, dst, src);
|
||||
+ ret = record_aes_gcm_encrypt_size(&ctx->rekey_counter, src_size);
|
||||
+ if (ret < 0) {
|
||||
+ return gnutls_assert_val(ret);
|
||||
+ }
|
||||
+
|
||||
+ GCM_ENCRYPT(&ctx->inner, x86_aes_encrypt, src_size, dst, src);
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -150,7 +160,7 @@ aes_gcm_decrypt(void *_ctx, const void *src, size_t src_size,
|
||||
if (unlikely(dst_size < src_size))
|
||||
return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
|
||||
|
||||
- GCM_DECRYPT(ctx, x86_aes_encrypt, src_size, dst, src);
|
||||
+ GCM_DECRYPT(&ctx->inner, x86_aes_encrypt, src_size, dst, src);
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -158,7 +168,7 @@ static int aes_gcm_auth(void *_ctx, const void *src, size_t src_size)
|
||||
{
|
||||
struct gcm_x86_aes_ctx *ctx = _ctx;
|
||||
|
||||
- GCM_UPDATE(ctx, src_size, src);
|
||||
+ GCM_UPDATE(&ctx->inner, src_size, src);
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -167,7 +177,7 @@ static void aes_gcm_tag(void *_ctx, void *tag, size_t tagsize)
|
||||
{
|
||||
struct gcm_x86_aes_ctx *ctx = _ctx;
|
||||
|
||||
- GCM_DIGEST(ctx, x86_aes_encrypt, tagsize, tag);
|
||||
+ GCM_DIGEST(&ctx->inner, x86_aes_encrypt, tagsize, tag);
|
||||
}
|
||||
|
||||
static void aes_gcm_deinit(void *_ctx)
|
||||
diff --git a/lib/accelerated/x86/aes-gcm-x86-pclmul-avx.c b/lib/accelerated/x86/aes-gcm-x86-pclmul-avx.c
|
||||
index 21aef94440..fbefe432f4 100644
|
||||
--- a/lib/accelerated/x86/aes-gcm-x86-pclmul-avx.c
|
||||
+++ b/lib/accelerated/x86/aes-gcm-x86-pclmul-avx.c
|
||||
@@ -61,6 +61,7 @@ struct aes_gcm_ctx {
|
||||
struct gcm128_context gcm;
|
||||
unsigned finished;
|
||||
unsigned auth_finished;
|
||||
+ size_t rekey_counter;
|
||||
};
|
||||
|
||||
void gcm_init_avx(u128 Htable[16], const uint64_t Xi[2]);
|
||||
@@ -116,6 +117,7 @@ aes_gcm_cipher_setkey(void *_ctx, const void *userkey, size_t keysize)
|
||||
|
||||
gcm_init_avx(ctx->gcm.Htable, ctx->gcm.H.u);
|
||||
|
||||
+ ctx->rekey_counter = 0;
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -140,6 +142,7 @@ static int aes_gcm_setiv(void *_ctx, const void *iv, size_t iv_size)
|
||||
ctx->gcm.Yi.c[GCM_BLOCK_SIZE - 1] = 2;
|
||||
ctx->finished = 0;
|
||||
ctx->auth_finished = 0;
|
||||
+ ctx->rekey_counter = 0;
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -184,6 +187,7 @@ aes_gcm_encrypt(void *_ctx, const void *src, size_t src_size,
|
||||
int exp_blocks = blocks * GCM_BLOCK_SIZE;
|
||||
int rest = src_size - (exp_blocks);
|
||||
uint32_t counter;
|
||||
+ int ret;
|
||||
|
||||
if (unlikely(ctx->finished))
|
||||
return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
|
||||
@@ -191,6 +195,11 @@ aes_gcm_encrypt(void *_ctx, const void *src, size_t src_size,
|
||||
if (unlikely(length < src_size))
|
||||
return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
|
||||
|
||||
+ ret = record_aes_gcm_encrypt_size(&ctx->rekey_counter, src_size);
|
||||
+ if (ret < 0) {
|
||||
+ return gnutls_assert_val(ret);
|
||||
+ }
|
||||
+
|
||||
if (blocks > 0) {
|
||||
aesni_ctr32_encrypt_blocks(src, dst,
|
||||
blocks,
|
||||
diff --git a/lib/accelerated/x86/aes-gcm-x86-pclmul.c b/lib/accelerated/x86/aes-gcm-x86-pclmul.c
|
||||
index e6b4990cbf..5385acbb6b 100644
|
||||
--- a/lib/accelerated/x86/aes-gcm-x86-pclmul.c
|
||||
+++ b/lib/accelerated/x86/aes-gcm-x86-pclmul.c
|
||||
@@ -60,6 +60,7 @@ struct aes_gcm_ctx {
|
||||
struct gcm128_context gcm;
|
||||
unsigned finished;
|
||||
unsigned auth_finished;
|
||||
+ size_t rekey_counter;
|
||||
};
|
||||
|
||||
void gcm_init_clmul(u128 Htable[16], const uint64_t Xi[2]);
|
||||
@@ -116,6 +117,7 @@ aes_gcm_cipher_setkey(void *_ctx, const void *userkey, size_t keysize)
|
||||
|
||||
gcm_init_clmul(ctx->gcm.Htable, ctx->gcm.H.u);
|
||||
|
||||
+ ctx->rekey_counter = 0;
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -140,6 +142,7 @@ static int aes_gcm_setiv(void *_ctx, const void *iv, size_t iv_size)
|
||||
ctx->gcm.Yi.c[GCM_BLOCK_SIZE - 1] = 2;
|
||||
ctx->finished = 0;
|
||||
ctx->auth_finished = 0;
|
||||
+ ctx->rekey_counter = 0;
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -184,6 +187,7 @@ aes_gcm_encrypt(void *_ctx, const void *src, size_t src_size,
|
||||
int exp_blocks = blocks * GCM_BLOCK_SIZE;
|
||||
int rest = src_size - (exp_blocks);
|
||||
uint32_t counter;
|
||||
+ int ret;
|
||||
|
||||
if (unlikely(ctx->finished))
|
||||
return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
|
||||
@@ -191,6 +195,11 @@ aes_gcm_encrypt(void *_ctx, const void *src, size_t src_size,
|
||||
if (unlikely(length < src_size))
|
||||
return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
|
||||
|
||||
+ ret = record_aes_gcm_encrypt_size(&ctx->rekey_counter, src_size);
|
||||
+ if (ret < 0) {
|
||||
+ return gnutls_assert_val(ret);
|
||||
+ }
|
||||
+
|
||||
if (blocks > 0) {
|
||||
aesni_ctr32_encrypt_blocks(src, dst,
|
||||
blocks,
|
||||
diff --git a/lib/accelerated/x86/aes-gcm-x86-ssse3.c b/lib/accelerated/x86/aes-gcm-x86-ssse3.c
|
||||
index 7a2ac50869..f074cb1096 100644
|
||||
--- a/lib/accelerated/x86/aes-gcm-x86-ssse3.c
|
||||
+++ b/lib/accelerated/x86/aes-gcm-x86-ssse3.c
|
||||
@@ -36,13 +36,15 @@
|
||||
#include <x86-common.h>
|
||||
#include <byteswap.h>
|
||||
#include <nettle/gcm.h>
|
||||
-#include <aes-x86.h>
|
||||
#include <assert.h>
|
||||
|
||||
/* GCM mode
|
||||
* It is used when the CPU doesn't include the PCLMUL instructions.
|
||||
*/
|
||||
-struct gcm_x86_aes_ctx GCM_CTX(AES_KEY);
|
||||
+struct gcm_x86_aes_ctx {
|
||||
+ struct GCM_CTX(AES_KEY) inner;
|
||||
+ size_t rekey_counter;
|
||||
+};
|
||||
|
||||
static void x86_aes_encrypt(const void *_ctx,
|
||||
size_t length, uint8_t * dst,
|
||||
@@ -110,17 +112,18 @@ aes_gcm_cipher_setkey(void *_ctx, const void *key, size_t keysize)
|
||||
struct gcm_x86_aes_ctx *ctx = _ctx;
|
||||
|
||||
if (keysize == 16) {
|
||||
- GCM_SET_KEY(ctx, x86_aes_128_set_encrypt_key, x86_aes_encrypt,
|
||||
+ GCM_SET_KEY(&ctx->inner, x86_aes_128_set_encrypt_key, x86_aes_encrypt,
|
||||
key);
|
||||
} else if (keysize == 24) {
|
||||
- GCM_SET_KEY(ctx, x86_aes_192_set_encrypt_key, x86_aes_encrypt,
|
||||
+ GCM_SET_KEY(&ctx->inner, x86_aes_192_set_encrypt_key, x86_aes_encrypt,
|
||||
key);
|
||||
} else if (keysize == 32) {
|
||||
- GCM_SET_KEY(ctx, x86_aes_256_set_encrypt_key, x86_aes_encrypt,
|
||||
+ GCM_SET_KEY(&ctx->inner, x86_aes_256_set_encrypt_key, x86_aes_encrypt,
|
||||
key);
|
||||
} else
|
||||
return GNUTLS_E_INVALID_REQUEST;
|
||||
|
||||
+ ctx->rekey_counter = 0;
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -131,8 +134,9 @@ static int aes_gcm_setiv(void *_ctx, const void *iv, size_t iv_size)
|
||||
if (iv_size != GCM_BLOCK_SIZE - 4)
|
||||
return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
|
||||
|
||||
- GCM_SET_IV(ctx, iv_size, iv);
|
||||
+ GCM_SET_IV(&ctx->inner, iv_size, iv);
|
||||
|
||||
+ ctx->rekey_counter = 0;
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -141,11 +145,17 @@ aes_gcm_encrypt(void *_ctx, const void *src, size_t src_size,
|
||||
void *dst, size_t length)
|
||||
{
|
||||
struct gcm_x86_aes_ctx *ctx = _ctx;
|
||||
+ int ret;
|
||||
|
||||
if (unlikely(length < src_size))
|
||||
return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
|
||||
|
||||
- GCM_ENCRYPT(ctx, x86_aes_encrypt, src_size, dst, src);
|
||||
+ ret = record_aes_gcm_encrypt_size(&ctx->rekey_counter, src_size);
|
||||
+ if (ret < 0) {
|
||||
+ return gnutls_assert_val(ret);
|
||||
+ }
|
||||
+
|
||||
+ GCM_ENCRYPT(&ctx->inner, x86_aes_encrypt, src_size, dst, src);
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -159,7 +169,7 @@ aes_gcm_decrypt(void *_ctx, const void *src, size_t src_size,
|
||||
if (unlikely(dst_size < src_size))
|
||||
return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
|
||||
|
||||
- GCM_DECRYPT(ctx, x86_aes_encrypt, src_size, dst, src);
|
||||
+ GCM_DECRYPT(&ctx->inner, x86_aes_encrypt, src_size, dst, src);
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -167,7 +177,7 @@ static int aes_gcm_auth(void *_ctx, const void *src, size_t src_size)
|
||||
{
|
||||
struct gcm_x86_aes_ctx *ctx = _ctx;
|
||||
|
||||
- GCM_UPDATE(ctx, src_size, src);
|
||||
+ GCM_UPDATE(&ctx->inner, src_size, src);
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -176,7 +186,7 @@ static void aes_gcm_tag(void *_ctx, void *tag, size_t tagsize)
|
||||
{
|
||||
struct gcm_x86_aes_ctx *ctx = _ctx;
|
||||
|
||||
- GCM_DIGEST(ctx, x86_aes_encrypt, tagsize, tag);
|
||||
+ GCM_DIGEST(&ctx->inner, x86_aes_encrypt, tagsize, tag);
|
||||
}
|
||||
|
||||
static void aes_gcm_deinit(void *_ctx)
|
||||
diff --git a/lib/accelerated/x86/aes-x86.h b/lib/accelerated/x86/aes-x86.h
|
||||
index 023b5f7be6..349d3d5d9c 100644
|
||||
--- a/lib/accelerated/x86/aes-x86.h
|
||||
+++ b/lib/accelerated/x86/aes-x86.h
|
||||
@@ -22,6 +22,21 @@ typedef struct {
|
||||
if (s != 16 && s != 24 && s != 32) \
|
||||
return GNUTLS_E_INVALID_REQUEST
|
||||
|
||||
+#include <intprops.h>
|
||||
+#define AES_GCM_ENCRYPT_MAX_BYTES ((1ULL << 36) - 32)
|
||||
+static inline int
|
||||
+record_aes_gcm_encrypt_size(size_t *counter, size_t size) {
|
||||
+ size_t sum;
|
||||
+
|
||||
+ if (!INT_ADD_OK(*counter, size, &sum) ||
|
||||
+ sum > AES_GCM_ENCRYPT_MAX_BYTES) {
|
||||
+ return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
|
||||
+ }
|
||||
+ *counter = sum;
|
||||
+
|
||||
+ return 0;
|
||||
+}
|
||||
+
|
||||
void aesni_ecb_encrypt(const unsigned char *in, unsigned char *out,
|
||||
size_t len, const AES_KEY * key, int enc);
|
||||
|
||||
diff --git a/lib/nettle/cipher.c b/lib/nettle/cipher.c
|
||||
index ab4c46d2d0..b41862d1ea 100644
|
||||
--- a/lib/nettle/cipher.c
|
||||
+++ b/lib/nettle/cipher.c
|
||||
@@ -63,6 +63,7 @@
|
||||
#include <nettle/xts.h>
|
||||
#include <nettle/siv-cmac.h>
|
||||
#include <fips.h>
|
||||
+#include <intprops.h>
|
||||
|
||||
struct nettle_cipher_ctx;
|
||||
|
||||
@@ -120,8 +121,23 @@ struct nettle_cipher_ctx {
|
||||
unsigned iv_size;
|
||||
|
||||
bool enc;
|
||||
+ size_t rekey_counter;
|
||||
};
|
||||
|
||||
+#define AES_GCM_ENCRYPT_MAX_BYTES ((1ULL << 36) - 32)
|
||||
+static inline int
|
||||
+record_aes_gcm_encrypt_size(size_t *counter, size_t size) {
|
||||
+ size_t sum;
|
||||
+
|
||||
+ if (!INT_ADD_OK(*counter, size, &sum) ||
|
||||
+ sum > AES_GCM_ENCRYPT_MAX_BYTES) {
|
||||
+ return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
|
||||
+ }
|
||||
+ *counter = sum;
|
||||
+
|
||||
+ return 0;
|
||||
+}
|
||||
+
|
||||
static void
|
||||
_stream_encrypt(struct nettle_cipher_ctx *ctx, size_t length, uint8_t * dst,
|
||||
const uint8_t * src)
|
||||
@@ -1133,6 +1149,16 @@ wrap_nettle_cipher_setkey(void *_ctx, const void *key, size_t keysize)
|
||||
else
|
||||
ctx->cipher->set_decrypt_key(ctx->ctx_ptr, key);
|
||||
|
||||
+ switch (ctx->cipher->algo) {
|
||||
+ case GNUTLS_CIPHER_AES_128_GCM:
|
||||
+ case GNUTLS_CIPHER_AES_192_GCM:
|
||||
+ case GNUTLS_CIPHER_AES_256_GCM:
|
||||
+ ctx->rekey_counter = 0;
|
||||
+ break;
|
||||
+ default:
|
||||
+ break;
|
||||
+ }
|
||||
+
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -1147,6 +1173,7 @@ wrap_nettle_cipher_setiv(void *_ctx, const void *iv, size_t iv_size)
|
||||
case GNUTLS_CIPHER_AES_192_GCM:
|
||||
case GNUTLS_CIPHER_AES_256_GCM:
|
||||
FIPS_RULE(iv_size < GCM_IV_SIZE, GNUTLS_E_INVALID_REQUEST, "access to short GCM nonce size\n");
|
||||
+ ctx->rekey_counter = 0;
|
||||
break;
|
||||
case GNUTLS_CIPHER_SALSA20_256:
|
||||
case GNUTLS_CIPHER_ESTREAM_SALSA20_256:
|
||||
@@ -1207,10 +1234,24 @@ wrap_nettle_cipher_encrypt(void *_ctx, const void *plain, size_t plain_size,
|
||||
void *encr, size_t encr_size)
|
||||
{
|
||||
struct nettle_cipher_ctx *ctx = _ctx;
|
||||
+ int ret;
|
||||
|
||||
if (unlikely(ctx->cipher->encrypt == NULL))
|
||||
return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
|
||||
|
||||
+ switch (ctx->cipher->algo) {
|
||||
+ case GNUTLS_CIPHER_AES_128_GCM:
|
||||
+ case GNUTLS_CIPHER_AES_192_GCM:
|
||||
+ case GNUTLS_CIPHER_AES_256_GCM:
|
||||
+ ret = record_aes_gcm_encrypt_size(&ctx->rekey_counter, plain_size);
|
||||
+ if (ret < 0) {
|
||||
+ return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
|
||||
+ }
|
||||
+ break;
|
||||
+ default:
|
||||
+ break;
|
||||
+ }
|
||||
+
|
||||
ctx->cipher->encrypt(ctx, plain_size, encr, plain);
|
||||
|
||||
return 0;
|
||||
diff --git a/tests/slow/cipher-api-test.c b/tests/slow/cipher-api-test.c
|
||||
index fc880bcc9f..1d267ce312 100644
|
||||
--- a/tests/slow/cipher-api-test.c
|
||||
+++ b/tests/slow/cipher-api-test.c
|
||||
@@ -21,6 +21,7 @@
|
||||
*/
|
||||
|
||||
#include <config.h>
|
||||
+#include <limits.h>
|
||||
#include <stdint.h>
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
@@ -48,6 +49,11 @@ int main(int argc, char **argv)
|
||||
#include <assert.h>
|
||||
#include <utils.h>
|
||||
|
||||
+#define AES_GCM_ENCRYPT_PLAINTEXT_MAX ((1ULL << 36) - 32)
|
||||
+#if SIZE_MAX >= AES_GCM_ENCRYPT_PLAINTEXT_MAX
|
||||
+#define TEST_AES_GCM_ENCRYPT_PLAINTEXT_SIZE 1
|
||||
+#endif
|
||||
+
|
||||
static void tls_log_func(int level, const char *str)
|
||||
{
|
||||
fprintf(stderr, "<%d>| %s", level, str);
|
||||
@@ -401,6 +407,74 @@ static void test_aead_invalid_short_decrypt(int algo)
|
||||
return;
|
||||
}
|
||||
|
||||
+#ifdef TEST_AES_GCM_ENCRYPT_PLAINTEXT_SIZE
|
||||
+/* Test whether an invalid call to gnutls_cipher_encrypt() with too
|
||||
+ * long message is caught */
|
||||
+static void test_aead_invalid_too_long_encrypt(int algo)
|
||||
+{
|
||||
+ int ret;
|
||||
+ gnutls_cipher_hd_t ch;
|
||||
+ uint8_t key16[64];
|
||||
+ uint8_t iv16[32];
|
||||
+ uint8_t data[128];
|
||||
+ gnutls_datum_t key, iv;
|
||||
+
|
||||
+ if (algo != GNUTLS_CIPHER_AES_128_GCM &&
|
||||
+ algo != GNUTLS_CIPHER_AES_192_GCM &&
|
||||
+ algo != GNUTLS_CIPHER_AES_256_GCM) {
|
||||
+ return;
|
||||
+ }
|
||||
+
|
||||
+ key.data = key16;
|
||||
+ key.size = gnutls_cipher_get_key_size(algo);
|
||||
+ assert(key.size <= sizeof(key16));
|
||||
+
|
||||
+ iv.data = iv16;
|
||||
+ iv.size = gnutls_cipher_get_iv_size(algo);
|
||||
+ assert(iv.size <= sizeof(iv16));
|
||||
+
|
||||
+ memset(iv.data, 0xff, iv.size);
|
||||
+ memset(key.data, 0xfe, key.size);
|
||||
+ memset(data, 0xfa, sizeof(data));
|
||||
+
|
||||
+ gnutls_global_set_log_function(tls_log_func);
|
||||
+ if (debug)
|
||||
+ gnutls_global_set_log_level(4711);
|
||||
+
|
||||
+ ret = global_init();
|
||||
+ if (ret < 0) {
|
||||
+ fail("Cannot initialize library\n"); /*errcode 1 */
|
||||
+ }
|
||||
+
|
||||
+ ret = gnutls_cipher_init(&ch, algo, &key, &iv);
|
||||
+ if (ret < 0)
|
||||
+ fail("gnutls_cipher_init failed\n"); /*errcode 1 */
|
||||
+
|
||||
+ /* Test exceeding AES-GCM plaintext limit */
|
||||
+ ret = gnutls_cipher_encrypt(ch, data, sizeof(data));
|
||||
+ if (ret < 0)
|
||||
+ fail("could not encrypt data\n");
|
||||
+
|
||||
+ /* A few blocks larger than AES_GCM_ENCRYPT_PLAINTEXT_MAX combined with
|
||||
+ * the previous call. Use NULL for PLAINTEXT so the access to the first
|
||||
+ * block always results in page fault (in case the limit is not
|
||||
+ * enforced).
|
||||
+ */
|
||||
+ ret = gnutls_cipher_encrypt(ch, NULL, AES_GCM_ENCRYPT_PLAINTEXT_MAX);
|
||||
+ if (ret >= 0)
|
||||
+ fail("succeeded in encrypting too long data\n");
|
||||
+ if (ret != GNUTLS_E_INVALID_REQUEST)
|
||||
+ fail("wrong kind of error on encrypting too long data,"
|
||||
+ "%s instead of GNUTLS_E_INVALID_REQUEST\n",
|
||||
+ gnutls_strerror_name(ret));
|
||||
+
|
||||
+ gnutls_cipher_deinit(ch);
|
||||
+
|
||||
+ gnutls_global_deinit();
|
||||
+ return;
|
||||
+}
|
||||
+#endif
|
||||
+
|
||||
static void check_status(int status)
|
||||
{
|
||||
if (WEXITSTATUS(status) != 0 ||
|
||||
@@ -464,6 +538,11 @@ void start(const char *name, int algo, unsigned aead)
|
||||
|
||||
success("trying %s: test_aead_invalid_short_decrypt\n", name);
|
||||
fork_subtest(test_aead_invalid_short_decrypt, algo);
|
||||
+
|
||||
+#if TEST_AES_GCM_ENCRYPT_PLAINTEXT_SIZE
|
||||
+ success("trying %s: test_aead_invalid_too_long_encrypt\n", name);
|
||||
+ fork_subtest(test_aead_invalid_too_long_encrypt, algo);
|
||||
+#endif
|
||||
}
|
||||
}
|
||||
|
||||
--
|
||||
2.37.1
|
||||
|
|
@ -1,119 +0,0 @@
|
|||
From 8ff391fa011e02c88b0d099061ca62e88ab68011 Mon Sep 17 00:00:00 2001
|
||||
From: Daiki Ueno <ueno@gnu.org>
|
||||
Date: Mon, 15 Aug 2022 09:39:18 +0900
|
||||
Subject: [PATCH] accelerated: clear AVX bits if it cannot be queried through
|
||||
XSAVE
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
The algorithm to detect AVX is described in 14.3 of "Intel® 64 and IA-32
|
||||
Architectures Software Developer’s Manual".
|
||||
|
||||
GnuTLS previously only followed that algorithm when registering the
|
||||
crypto backend, while the CRYPTOGAMS derived SHA code assembly expects
|
||||
that the extension bits are propagated to _gnutls_x86_cpuid_s.
|
||||
|
||||
Signed-off-by: Daiki Ueno <ueno@gnu.org>
|
||||
---
|
||||
lib/accelerated/x86/x86-common.c | 49 +++++++++++++++++++++++++-------
|
||||
1 file changed, 38 insertions(+), 11 deletions(-)
|
||||
|
||||
diff --git a/lib/accelerated/x86/x86-common.c b/lib/accelerated/x86/x86-common.c
|
||||
index 7ddaa594e6..b7a88ddeca 100644
|
||||
--- a/lib/accelerated/x86/x86-common.c
|
||||
+++ b/lib/accelerated/x86/x86-common.c
|
||||
@@ -81,6 +81,26 @@ unsigned int _gnutls_x86_cpuid_s[4];
|
||||
# define bit_AVX 0x10000000
|
||||
#endif
|
||||
|
||||
+#ifndef bit_AVX2
|
||||
+# define bit_AVX2 0x00000020
|
||||
+#endif
|
||||
+
|
||||
+#ifndef bit_AVX512F
|
||||
+# define bit_AVX512F 0x00010000
|
||||
+#endif
|
||||
+
|
||||
+#ifndef bit_AVX512IFMA
|
||||
+# define bit_AVX512IFMA 0x00200000
|
||||
+#endif
|
||||
+
|
||||
+#ifndef bit_AVX512BW
|
||||
+# define bit_AVX512BW 0x40000000
|
||||
+#endif
|
||||
+
|
||||
+#ifndef bit_AVX512VL
|
||||
+# define bit_AVX512VL 0x80000000
|
||||
+#endif
|
||||
+
|
||||
#ifndef bit_OSXSAVE
|
||||
# define bit_OSXSAVE 0x8000000
|
||||
#endif
|
||||
@@ -89,10 +109,6 @@ unsigned int _gnutls_x86_cpuid_s[4];
|
||||
# define bit_MOVBE 0x00400000
|
||||
#endif
|
||||
|
||||
-#ifndef OSXSAVE_MASK
|
||||
-# define OSXSAVE_MASK (bit_OSXSAVE|bit_MOVBE)
|
||||
-#endif
|
||||
-
|
||||
#define bit_PADLOCK (0x3 << 6)
|
||||
#define bit_PADLOCK_PHE (0x3 << 10)
|
||||
#define bit_PADLOCK_PHE_SHA512 (0x3 << 25)
|
||||
@@ -148,7 +164,7 @@ static unsigned check_4th_gen_intel_features(unsigned ecx)
|
||||
{
|
||||
uint32_t xcr0;
|
||||
|
||||
- if ((ecx & OSXSAVE_MASK) != OSXSAVE_MASK)
|
||||
+ if ((ecx & bit_OSXSAVE) != bit_OSXSAVE)
|
||||
return 0;
|
||||
|
||||
#if defined(_MSC_VER) && !defined(__clang__)
|
||||
@@ -190,8 +206,9 @@ static void capabilities_to_intel_cpuid(unsigned capabilities)
|
||||
}
|
||||
|
||||
if (capabilities & INTEL_AVX) {
|
||||
- if ((a[1] & bit_AVX) && check_4th_gen_intel_features(a[1])) {
|
||||
- _gnutls_x86_cpuid_s[1] |= bit_AVX|OSXSAVE_MASK;
|
||||
+ if ((a[1] & bit_AVX) && (a[1] & bit_MOVBE) &&
|
||||
+ check_4th_gen_intel_features(a[1])) {
|
||||
+ _gnutls_x86_cpuid_s[1] |= bit_AVX|bit_MOVBE;
|
||||
} else {
|
||||
_gnutls_debug_log
|
||||
("AVX acceleration requested but not available\n");
|
||||
@@ -236,10 +253,7 @@ static unsigned check_sha(void)
|
||||
#ifdef ASM_X86_64
|
||||
static unsigned check_avx_movbe(void)
|
||||
{
|
||||
- if (check_4th_gen_intel_features(_gnutls_x86_cpuid_s[1]) == 0)
|
||||
- return 0;
|
||||
-
|
||||
- return ((_gnutls_x86_cpuid_s[1] & bit_AVX));
|
||||
+ return (_gnutls_x86_cpuid_s[1] & (bit_AVX|bit_MOVBE)) == (bit_AVX|bit_MOVBE);
|
||||
}
|
||||
|
||||
static unsigned check_pclmul(void)
|
||||
@@ -884,6 +898,19 @@ void register_x86_intel_crypto(unsigned capabilities)
|
||||
if (capabilities == 0) {
|
||||
if (!read_cpuid_vals(_gnutls_x86_cpuid_s))
|
||||
return;
|
||||
+ if (!check_4th_gen_intel_features(_gnutls_x86_cpuid_s[1])) {
|
||||
+ _gnutls_x86_cpuid_s[1] &= ~bit_AVX;
|
||||
+
|
||||
+ /* Clear AVX2 bits as well, according to what
|
||||
+ * OpenSSL does. Should we clear
|
||||
+ * bit_AVX512DQ, bit_AVX512PF, bit_AVX512ER,
|
||||
+ * and bit_AVX512CD? */
|
||||
+ _gnutls_x86_cpuid_s[2] &= ~(bit_AVX2|
|
||||
+ bit_AVX512F|
|
||||
+ bit_AVX512IFMA|
|
||||
+ bit_AVX512BW|
|
||||
+ bit_AVX512BW);
|
||||
+ }
|
||||
} else {
|
||||
capabilities_to_intel_cpuid(capabilities);
|
||||
}
|
||||
--
|
||||
2.37.2
|
||||
|
|
@ -1,41 +0,0 @@
|
|||
From 3035e884b3abc68bcebff5adec5bd8819bbc6d7b Mon Sep 17 00:00:00 2001
|
||||
From: rpm-build <rpm-build>
|
||||
Date: Fri, 5 Aug 2022 16:16:42 +0900
|
||||
Subject: [PATCH] gnutls-3.7.6-drbg-reseed.patch
|
||||
|
||||
Signed-off-by: rpm-build <rpm-build>
|
||||
---
|
||||
lib/nettle/sysrng-linux.c | 10 +++++++++-
|
||||
1 file changed, 9 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/lib/nettle/sysrng-linux.c b/lib/nettle/sysrng-linux.c
|
||||
index 6b3971c..dae9061 100644
|
||||
--- a/lib/nettle/sysrng-linux.c
|
||||
+++ b/lib/nettle/sysrng-linux.c
|
||||
@@ -31,6 +31,9 @@
|
||||
# include <num.h>
|
||||
# include <errno.h>
|
||||
# include <rnd-common.h>
|
||||
+# include "fips.h"
|
||||
+#else
|
||||
+# define _gnutls_fips_mode_enabled() 0
|
||||
#endif
|
||||
|
||||
#include <sys/types.h>
|
||||
@@ -103,7 +106,12 @@ static int force_getrandom(void *buf, size_t buflen, unsigned int flags)
|
||||
static int _rnd_get_system_entropy_getrandom(void* _rnd, size_t size)
|
||||
{
|
||||
int ret;
|
||||
- ret = force_getrandom(_rnd, size, 0);
|
||||
+ unsigned int flags = 0;
|
||||
+
|
||||
+ if (_gnutls_fips_mode_enabled()) {
|
||||
+ flags |= 2/*GRND_RANDOM*/;
|
||||
+ }
|
||||
+ ret = force_getrandom(_rnd, size, flags);
|
||||
if (ret == -1) {
|
||||
int e = errno;
|
||||
gnutls_assert();
|
||||
--
|
||||
2.37.1
|
||||
|
|
@ -1,331 +0,0 @@
|
|||
From 26b2caef673aba8bfd10db3b1b8117f941c18e58 Mon Sep 17 00:00:00 2001
|
||||
From: Daiki Ueno <ueno@gnu.org>
|
||||
Date: Fri, 21 Oct 2022 15:48:39 +0900
|
||||
Subject: [PATCH] cipher: add restriction on CCM tag length under FIPS mode
|
||||
|
||||
This change prohibits any use of tag length other than 4, 6, 8, 10,
|
||||
12, 14, and 16 bytes in CCM used under FIPS mode, in accordance with
|
||||
SP800-38C A.1. While use of tag lengths smaller than 8 bytes is not
|
||||
recommended, we simply allow 4 and 6 bytes tags for now.
|
||||
|
||||
Signed-off-by: Daiki Ueno <ueno@gnu.org>
|
||||
---
|
||||
lib/accelerated/aarch64/aes-ccm-aarch64.c | 39 ++++++++++
|
||||
lib/accelerated/x86/aes-ccm-x86-aesni.c | 39 ++++++++++
|
||||
lib/nettle/cipher.c | 55 ++++++++++++++
|
||||
tests/fips-test.c | 87 ++++++++++++++++++++++-
|
||||
4 files changed, 218 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/lib/accelerated/aarch64/aes-ccm-aarch64.c b/lib/accelerated/aarch64/aes-ccm-aarch64.c
|
||||
index a2ba259e99..b415d4ddfb 100644
|
||||
--- a/lib/accelerated/aarch64/aes-ccm-aarch64.c
|
||||
+++ b/lib/accelerated/aarch64/aes-ccm-aarch64.c
|
||||
@@ -36,6 +36,7 @@
|
||||
#include <byteswap.h>
|
||||
#include <nettle/ccm.h>
|
||||
#include <aes-aarch64.h>
|
||||
+#include <fips.h>
|
||||
|
||||
typedef struct ccm_aarch64_aes_ctx {
|
||||
AES_KEY key;
|
||||
@@ -103,6 +104,25 @@ aes_ccm_aead_encrypt(void *_ctx,
|
||||
if (unlikely(encr_size < plain_size + tag_size))
|
||||
return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
|
||||
|
||||
+ /* SP800-38C A.1 says Tlen must be a multiple of 16 between 32
|
||||
+ * and 128.
|
||||
+ */
|
||||
+ switch (tag_size) {
|
||||
+ case 4: case 6:
|
||||
+ /* SP800-38C B.2 says Tlen smaller than 64 should not be used
|
||||
+ * under sufficient restriction. We simply allow those for now.
|
||||
+ */
|
||||
+ FALLTHROUGH;
|
||||
+ case 8: case 10: case 12: case 14: case 16:
|
||||
+ break;
|
||||
+ default:
|
||||
+ if (_gnutls_fips_mode_enabled()) {
|
||||
+ _gnutls_switch_fips_state(GNUTLS_FIPS140_OP_ERROR);
|
||||
+ return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
|
||||
+ }
|
||||
+ break;
|
||||
+ }
|
||||
+
|
||||
ccm_encrypt_message(&ctx->key, aarch64_aes_encrypt,
|
||||
nonce_size, nonce,
|
||||
auth_size, auth,
|
||||
@@ -129,6 +149,25 @@ aes_ccm_aead_decrypt(void *_ctx,
|
||||
if (unlikely(plain_size < encr_size - tag_size))
|
||||
return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
|
||||
|
||||
+ /* SP800-38C A.1 says Tlen must be a multiple of 16 between 32
|
||||
+ * and 128.
|
||||
+ */
|
||||
+ switch (tag_size) {
|
||||
+ case 4: case 6:
|
||||
+ /* SP800-38C B.2 says Tlen smaller than 64 should not be used
|
||||
+ * under sufficient restriction. We simply allow those for now.
|
||||
+ */
|
||||
+ FALLTHROUGH;
|
||||
+ case 8: case 10: case 12: case 14: case 16:
|
||||
+ break;
|
||||
+ default:
|
||||
+ if (_gnutls_fips_mode_enabled()) {
|
||||
+ _gnutls_switch_fips_state(GNUTLS_FIPS140_OP_ERROR);
|
||||
+ return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
|
||||
+ }
|
||||
+ break;
|
||||
+ }
|
||||
+
|
||||
ret = ccm_decrypt_message(&ctx->key, aarch64_aes_encrypt,
|
||||
nonce_size, nonce,
|
||||
auth_size, auth,
|
||||
diff --git a/lib/accelerated/x86/aes-ccm-x86-aesni.c b/lib/accelerated/x86/aes-ccm-x86-aesni.c
|
||||
index 701c0f992a..9ebbdd7b2a 100644
|
||||
--- a/lib/accelerated/x86/aes-ccm-x86-aesni.c
|
||||
+++ b/lib/accelerated/x86/aes-ccm-x86-aesni.c
|
||||
@@ -37,6 +37,7 @@
|
||||
#include <byteswap.h>
|
||||
#include <nettle/ccm.h>
|
||||
#include <aes-x86.h>
|
||||
+#include <fips.h>
|
||||
|
||||
typedef struct ccm_x86_aes_ctx {
|
||||
AES_KEY key;
|
||||
@@ -95,6 +96,25 @@ aes_ccm_aead_encrypt(void *_ctx,
|
||||
if (unlikely(encr_size < plain_size + tag_size))
|
||||
return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
|
||||
|
||||
+ /* SP800-38C A.1 says Tlen must be a multiple of 16 between 32
|
||||
+ * and 128.
|
||||
+ */
|
||||
+ switch (tag_size) {
|
||||
+ case 4: case 6:
|
||||
+ /* SP800-38C B.2 says Tlen smaller than 64 should not be used
|
||||
+ * under sufficient restriction. We simply allow those for now.
|
||||
+ */
|
||||
+ FALLTHROUGH;
|
||||
+ case 8: case 10: case 12: case 14: case 16:
|
||||
+ break;
|
||||
+ default:
|
||||
+ if (_gnutls_fips_mode_enabled()) {
|
||||
+ _gnutls_switch_fips_state(GNUTLS_FIPS140_OP_ERROR);
|
||||
+ return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
|
||||
+ }
|
||||
+ break;
|
||||
+ }
|
||||
+
|
||||
ccm_encrypt_message(&ctx->key, x86_aes_encrypt,
|
||||
nonce_size, nonce,
|
||||
auth_size, auth,
|
||||
@@ -121,6 +141,25 @@ aes_ccm_aead_decrypt(void *_ctx,
|
||||
if (unlikely(plain_size < encr_size - tag_size))
|
||||
return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
|
||||
|
||||
+ /* SP800-38C A.1 says Tlen must be a multiple of 16 between 32
|
||||
+ * and 128.
|
||||
+ */
|
||||
+ switch (tag_size) {
|
||||
+ case 4: case 6:
|
||||
+ /* SP800-38C B.2 says Tlen smaller than 64 should not be used
|
||||
+ * under sufficient restriction. We simply allow those for now.
|
||||
+ */
|
||||
+ FALLTHROUGH;
|
||||
+ case 8: case 10: case 12: case 14: case 16:
|
||||
+ break;
|
||||
+ default:
|
||||
+ if (_gnutls_fips_mode_enabled()) {
|
||||
+ _gnutls_switch_fips_state(GNUTLS_FIPS140_OP_ERROR);
|
||||
+ return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
|
||||
+ }
|
||||
+ break;
|
||||
+ }
|
||||
+
|
||||
ret = ccm_decrypt_message(&ctx->key, x86_aes_encrypt,
|
||||
nonce_size, nonce,
|
||||
auth_size, auth,
|
||||
diff --git a/lib/nettle/cipher.c b/lib/nettle/cipher.c
|
||||
index 9c2ce19e7e..8c23d11252 100644
|
||||
--- a/lib/nettle/cipher.c
|
||||
+++ b/lib/nettle/cipher.c
|
||||
@@ -1253,6 +1253,34 @@ wrap_nettle_cipher_aead_encrypt(void *_ctx,
|
||||
ctx->cipher->tag(ctx->ctx_ptr, tag_size, ((uint8_t*)encr) + plain_size);
|
||||
} else {
|
||||
/* CCM-style cipher */
|
||||
+
|
||||
+ switch (ctx->cipher->algo) {
|
||||
+ case GNUTLS_CIPHER_AES_128_CCM:
|
||||
+ case GNUTLS_CIPHER_AES_256_CCM:
|
||||
+ /* SP800-38C A.1 says Tlen must be a multiple of 16
|
||||
+ * between 32 and 128.
|
||||
+ */
|
||||
+ switch (tag_size) {
|
||||
+ case 4: case 6:
|
||||
+ /* SP800-38C B.2 says Tlen smaller than 64
|
||||
+ * should not be used under sufficient
|
||||
+ * restriction. We simply allow those for now.
|
||||
+ */
|
||||
+ FALLTHROUGH;
|
||||
+ case 8: case 10: case 12: case 14: case 16:
|
||||
+ break;
|
||||
+ default:
|
||||
+ if (_gnutls_fips_mode_enabled()) {
|
||||
+ _gnutls_switch_fips_state(GNUTLS_FIPS140_OP_ERROR);
|
||||
+ return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
|
||||
+ }
|
||||
+ break;
|
||||
+ }
|
||||
+ break;
|
||||
+ default:
|
||||
+ break;
|
||||
+ }
|
||||
+
|
||||
ctx->cipher->aead_encrypt(ctx,
|
||||
nonce_size, nonce,
|
||||
auth_size, auth,
|
||||
@@ -1302,6 +1330,33 @@ wrap_nettle_cipher_aead_decrypt(void *_ctx,
|
||||
if (unlikely(plain_size < encr_size))
|
||||
return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
|
||||
|
||||
+ switch (ctx->cipher->algo) {
|
||||
+ case GNUTLS_CIPHER_AES_128_CCM:
|
||||
+ case GNUTLS_CIPHER_AES_256_CCM:
|
||||
+ /* SP800-38C A.1 says Tlen must be a multiple of 16
|
||||
+ * between 32 and 128.
|
||||
+ */
|
||||
+ switch (tag_size) {
|
||||
+ case 4: case 6:
|
||||
+ /* SP800-38C B.2 says Tlen smaller than 64
|
||||
+ * should not be used under sufficient
|
||||
+ * restriction. We simply allow those for now.
|
||||
+ */
|
||||
+ FALLTHROUGH;
|
||||
+ case 8: case 10: case 12: case 14: case 16:
|
||||
+ break;
|
||||
+ default:
|
||||
+ if (_gnutls_fips_mode_enabled()) {
|
||||
+ _gnutls_switch_fips_state(GNUTLS_FIPS140_OP_ERROR);
|
||||
+ return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
|
||||
+ }
|
||||
+ break;
|
||||
+ }
|
||||
+ break;
|
||||
+ default:
|
||||
+ break;
|
||||
+ }
|
||||
+
|
||||
ret = ctx->cipher->aead_decrypt(ctx,
|
||||
nonce_size, nonce,
|
||||
auth_size, auth,
|
||||
diff --git a/tests/fips-test.c b/tests/fips-test.c
|
||||
index f7556d7bbb..c43503fba0 100644
|
||||
--- a/tests/fips-test.c
|
||||
+++ b/tests/fips-test.c
|
||||
@@ -1,4 +1,5 @@
|
||||
#include <config.h>
|
||||
+#include <stdbool.h>
|
||||
#include <stdint.h>
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
@@ -213,14 +214,96 @@ test_cipher_disallowed(gnutls_cipher_algorithm_t cipher)
|
||||
FIPS_POP_CONTEXT(ERROR);
|
||||
}
|
||||
|
||||
+static void
|
||||
+test_ccm_cipher(gnutls_cipher_algorithm_t cipher, size_t tag_length,
|
||||
+ bool expect_encryption_fail,
|
||||
+ gnutls_fips140_operation_state_t expected_state)
|
||||
+{
|
||||
+ int ret;
|
||||
+ unsigned key_size = gnutls_cipher_get_key_size(cipher);
|
||||
+ gnutls_aead_cipher_hd_t h;
|
||||
+ gnutls_datum_t key = { key_data, key_size };
|
||||
+ unsigned char buffer[256];
|
||||
+ size_t length;
|
||||
+ gnutls_memset(key_data, 0, key_size);
|
||||
+
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ ret = gnutls_aead_cipher_init(&h, cipher, &key);
|
||||
+ if (ret < 0) {
|
||||
+ fail("gnutls_aead_cipher_init failed for %s\n",
|
||||
+ gnutls_cipher_get_name(cipher));
|
||||
+ }
|
||||
+ FIPS_POP_CONTEXT(APPROVED);
|
||||
+
|
||||
+ fips_push_context(fips_context);
|
||||
+ memset(buffer, 0, sizeof(buffer));
|
||||
+ length = sizeof(buffer);
|
||||
+ ret = gnutls_aead_cipher_encrypt(h, iv_data,
|
||||
+ gnutls_cipher_get_iv_size(cipher),
|
||||
+ NULL, 0, tag_length,
|
||||
+ buffer, length - tag_length,
|
||||
+ buffer, &length);
|
||||
+ if (expect_encryption_fail) {
|
||||
+ if (ret != GNUTLS_E_INVALID_REQUEST) {
|
||||
+ fail("gnutls_aead_cipher_encrypt(%s) returned %d "
|
||||
+ "while %d is expected\n",
|
||||
+ gnutls_cipher_get_name(cipher),
|
||||
+ ret, GNUTLS_E_INVALID_REQUEST);
|
||||
+ }
|
||||
+ } else if (ret < 0) {
|
||||
+ fail("gnutls_aead_cipher_encrypt failed for %s\n",
|
||||
+ gnutls_cipher_get_name(cipher));
|
||||
+ }
|
||||
+ fips_pop_context(fips_context, expected_state);
|
||||
+
|
||||
+ fips_push_context(fips_context);
|
||||
+ length = sizeof(buffer);
|
||||
+ ret = gnutls_aead_cipher_decrypt(h, iv_data,
|
||||
+ gnutls_cipher_get_iv_size(cipher),
|
||||
+ NULL, 0, tag_length,
|
||||
+ buffer, length,
|
||||
+ buffer, &length);
|
||||
+ if (expect_encryption_fail) {
|
||||
+ if (ret != GNUTLS_E_INVALID_REQUEST) {
|
||||
+ fail("gnutls_aead_cipher_decrypt(%s) returned %d "
|
||||
+ "while %d is expected\n",
|
||||
+ gnutls_cipher_get_name(cipher),
|
||||
+ ret, GNUTLS_E_INVALID_REQUEST);
|
||||
+ }
|
||||
+ } else if (ret < 0) {
|
||||
+ fail("gnutls_aead_cipher_decrypt failed for %s\n",
|
||||
+ gnutls_cipher_get_name(cipher));
|
||||
+ }
|
||||
+ fips_pop_context(fips_context, expected_state);
|
||||
+
|
||||
+ gnutls_aead_cipher_deinit(h);
|
||||
+}
|
||||
+
|
||||
static inline void
|
||||
test_ciphers(void)
|
||||
{
|
||||
+ size_t i;
|
||||
+
|
||||
test_cipher_approved(GNUTLS_CIPHER_AES_128_CBC);
|
||||
test_cipher_approved(GNUTLS_CIPHER_AES_192_CBC);
|
||||
test_cipher_approved(GNUTLS_CIPHER_AES_256_CBC);
|
||||
- test_aead_cipher_approved(GNUTLS_CIPHER_AES_128_CCM);
|
||||
- test_aead_cipher_approved(GNUTLS_CIPHER_AES_256_CCM);
|
||||
+
|
||||
+ /* Check for all allowed Tlen */
|
||||
+ for (i = 4; i <= 16; i += 2) {
|
||||
+ test_ccm_cipher(GNUTLS_CIPHER_AES_128_CCM, i,
|
||||
+ false, GNUTLS_FIPS140_OP_APPROVED);
|
||||
+ test_ccm_cipher(GNUTLS_CIPHER_AES_256_CCM, i,
|
||||
+ false, GNUTLS_FIPS140_OP_APPROVED);
|
||||
+ }
|
||||
+ test_ccm_cipher(GNUTLS_CIPHER_AES_128_CCM, 3,
|
||||
+ true, GNUTLS_FIPS140_OP_ERROR);
|
||||
+ test_ccm_cipher(GNUTLS_CIPHER_AES_256_CCM, 3,
|
||||
+ true, GNUTLS_FIPS140_OP_ERROR);
|
||||
+ test_ccm_cipher(GNUTLS_CIPHER_AES_128_CCM, 5,
|
||||
+ true, GNUTLS_FIPS140_OP_ERROR);
|
||||
+ test_ccm_cipher(GNUTLS_CIPHER_AES_256_CCM, 5,
|
||||
+ true, GNUTLS_FIPS140_OP_ERROR);
|
||||
+
|
||||
test_aead_cipher_approved(GNUTLS_CIPHER_AES_128_CCM_8);
|
||||
test_aead_cipher_approved(GNUTLS_CIPHER_AES_256_CCM_8);
|
||||
test_cipher_approved(GNUTLS_CIPHER_AES_128_CFB8);
|
||||
--
|
||||
2.38.1
|
||||
|
|
@ -1,427 +0,0 @@
|
|||
From 171b934a8c054e98b110892cae4130e1db64e656 Mon Sep 17 00:00:00 2001
|
||||
From: rpm-build <rpm-build>
|
||||
Date: Thu, 29 Sep 2022 21:28:19 +0900
|
||||
Subject: [PATCH] gnutls-3.7.6-fips-ecdsa-hash-check.patch
|
||||
|
||||
---
|
||||
lib/crypto-backend.h | 12 ++--
|
||||
lib/nettle/pk.c | 33 +++++-----
|
||||
lib/privkey.c | 42 ++++++++----
|
||||
lib/pubkey.c | 5 +-
|
||||
tests/fips-test.c | 150 ++++++++++++++++++++++++++++++++++++++++++-
|
||||
5 files changed, 205 insertions(+), 37 deletions(-)
|
||||
|
||||
diff --git a/lib/crypto-backend.h b/lib/crypto-backend.h
|
||||
index f0f68c3..4dd1ae2 100644
|
||||
--- a/lib/crypto-backend.h
|
||||
+++ b/lib/crypto-backend.h
|
||||
@@ -247,11 +247,13 @@ typedef enum {
|
||||
GNUTLS_PK_FLAG_RSA_PSS_FIXED_SALT_LENGTH = 4
|
||||
} gnutls_pk_flag_t;
|
||||
|
||||
-#define FIX_SIGN_PARAMS(params, flags, dig) do { \
|
||||
- if ((flags) & GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE) { \
|
||||
- (params).flags |= GNUTLS_PK_FLAG_REPRODUCIBLE; \
|
||||
- (params).dsa_dig = (dig); \
|
||||
- } \
|
||||
+#define FIX_SIGN_PARAMS(params, flags, dig) do { \
|
||||
+ if ((flags) & GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE) { \
|
||||
+ (params).flags |= GNUTLS_PK_FLAG_REPRODUCIBLE; \
|
||||
+ } \
|
||||
+ if ((params).pk == GNUTLS_PK_DSA || (params).pk == GNUTLS_PK_ECDSA) { \
|
||||
+ (params).dsa_dig = (dig); \
|
||||
+ } \
|
||||
} while (0)
|
||||
|
||||
void gnutls_pk_params_release(gnutls_pk_params_st * p);
|
||||
diff --git a/lib/nettle/pk.c b/lib/nettle/pk.c
|
||||
index f38016b..c098e2a 100644
|
||||
--- a/lib/nettle/pk.c
|
||||
+++ b/lib/nettle/pk.c
|
||||
@@ -1104,8 +1104,16 @@ _wrap_nettle_pk_sign(gnutls_pk_algorithm_t algo,
|
||||
me = _gnutls_dsa_q_to_hash(pk_params,
|
||||
&hash_len);
|
||||
|
||||
+ if (hash_len > vdata->size) {
|
||||
+ gnutls_assert();
|
||||
+ _gnutls_debug_log
|
||||
+ ("Security level of algorithm requires hash %s(%d) or better\n",
|
||||
+ _gnutls_mac_get_name(me), hash_len);
|
||||
+ hash_len = vdata->size;
|
||||
+ }
|
||||
+
|
||||
/* Only SHA-2 is allowed in FIPS 140-3 */
|
||||
- switch (me->id) {
|
||||
+ switch (DIG_TO_MAC(sign_params->dsa_dig)) {
|
||||
case GNUTLS_MAC_SHA256:
|
||||
case GNUTLS_MAC_SHA384:
|
||||
case GNUTLS_MAC_SHA512:
|
||||
@@ -1115,14 +1123,6 @@ _wrap_nettle_pk_sign(gnutls_pk_algorithm_t algo,
|
||||
not_approved = true;
|
||||
}
|
||||
|
||||
- if (hash_len > vdata->size) {
|
||||
- gnutls_assert();
|
||||
- _gnutls_debug_log
|
||||
- ("Security level of algorithm requires hash %s(%d) or better\n",
|
||||
- _gnutls_mac_get_name(me), hash_len);
|
||||
- hash_len = vdata->size;
|
||||
- }
|
||||
-
|
||||
mpz_init(k);
|
||||
if (_gnutls_get_lib_state() == LIB_STATE_SELFTEST ||
|
||||
(sign_params->flags & GNUTLS_PK_FLAG_REPRODUCIBLE)) {
|
||||
@@ -1545,7 +1545,6 @@ _wrap_nettle_pk_verify(gnutls_pk_algorithm_t algo,
|
||||
struct dsa_signature sig;
|
||||
int curve_id = pk_params->curve;
|
||||
const struct ecc_curve *curve;
|
||||
- const mac_entry_st *me;
|
||||
|
||||
curve = get_supported_nist_curve(curve_id);
|
||||
if (curve == NULL) {
|
||||
@@ -1571,11 +1570,14 @@ _wrap_nettle_pk_verify(gnutls_pk_algorithm_t algo,
|
||||
memcpy(sig.r, tmp[0], SIZEOF_MPZT);
|
||||
memcpy(sig.s, tmp[1], SIZEOF_MPZT);
|
||||
|
||||
- me = _gnutls_dsa_q_to_hash(pk_params, &hash_len);
|
||||
+ (void)_gnutls_dsa_q_to_hash(pk_params, &hash_len);
|
||||
+
|
||||
+ if (hash_len > vdata->size)
|
||||
+ hash_len = vdata->size;
|
||||
|
||||
/* SHA-1 is allowed for SigVer in FIPS 140-3 in legacy
|
||||
* mode */
|
||||
- switch (me->id) {
|
||||
+ switch (DIG_TO_MAC(sign_params->dsa_dig)) {
|
||||
case GNUTLS_MAC_SHA1:
|
||||
case GNUTLS_MAC_SHA256:
|
||||
case GNUTLS_MAC_SHA384:
|
||||
@@ -1586,9 +1588,6 @@ _wrap_nettle_pk_verify(gnutls_pk_algorithm_t algo,
|
||||
not_approved = true;
|
||||
}
|
||||
|
||||
- if (hash_len > vdata->size)
|
||||
- hash_len = vdata->size;
|
||||
-
|
||||
ret =
|
||||
ecdsa_verify(&pub, hash_len, vdata->data,
|
||||
&sig);
|
||||
@@ -2390,8 +2389,10 @@ static int pct_test(gnutls_pk_algorithm_t algo, const gnutls_pk_params_st* param
|
||||
|
||||
if (algo == GNUTLS_PK_DSA || algo == GNUTLS_PK_EC) {
|
||||
unsigned hash_len;
|
||||
+ const mac_entry_st *me;
|
||||
|
||||
- _gnutls_dsa_q_to_hash(params, &hash_len);
|
||||
+ me = _gnutls_dsa_q_to_hash(params, &hash_len);
|
||||
+ spki.dsa_dig = MAC_TO_DIG(me->id);
|
||||
gen_data = gnutls_malloc(hash_len);
|
||||
gnutls_rnd(GNUTLS_RND_NONCE, gen_data, hash_len);
|
||||
|
||||
diff --git a/lib/privkey.c b/lib/privkey.c
|
||||
index 0b77443..2069fc0 100644
|
||||
--- a/lib/privkey.c
|
||||
+++ b/lib/privkey.c
|
||||
@@ -1251,27 +1251,36 @@ gnutls_privkey_sign_hash2(gnutls_privkey_t signer,
|
||||
se = _gnutls_sign_to_entry(GNUTLS_SIGN_RSA_RAW);
|
||||
} else {
|
||||
se = _gnutls_sign_to_entry(algo);
|
||||
- if (unlikely(se == NULL))
|
||||
- return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
|
||||
-
|
||||
+ if (unlikely(se == NULL)) {
|
||||
+ ret = gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
|
||||
+ goto cleanup;
|
||||
+ }
|
||||
}
|
||||
|
||||
ret = _gnutls_privkey_get_spki_params(signer, ¶ms);
|
||||
if (ret < 0) {
|
||||
gnutls_assert();
|
||||
- return ret;
|
||||
+ goto cleanup;
|
||||
}
|
||||
|
||||
ret = _gnutls_privkey_update_spki_params(signer, se->pk, se->hash,
|
||||
flags, ¶ms);
|
||||
if (ret < 0) {
|
||||
gnutls_assert();
|
||||
- return ret;
|
||||
+ goto cleanup;
|
||||
}
|
||||
|
||||
FIX_SIGN_PARAMS(params, flags, se->hash);
|
||||
|
||||
- return privkey_sign_prehashed(signer, se, hash_data, signature, ¶ms);
|
||||
+ ret = privkey_sign_prehashed(signer, se, hash_data, signature, ¶ms);
|
||||
+
|
||||
+ cleanup:
|
||||
+ if (ret < 0) {
|
||||
+ _gnutls_switch_fips_state(GNUTLS_FIPS140_OP_ERROR);
|
||||
+ } else {
|
||||
+ _gnutls_switch_fips_state(GNUTLS_FIPS140_OP_NOT_APPROVED);
|
||||
+ }
|
||||
+ return ret;
|
||||
}
|
||||
|
||||
int
|
||||
@@ -1366,14 +1375,14 @@ gnutls_privkey_sign_hash(gnutls_privkey_t signer,
|
||||
ret = _gnutls_privkey_get_spki_params(signer, ¶ms);
|
||||
if (ret < 0) {
|
||||
gnutls_assert();
|
||||
- return ret;
|
||||
+ goto cleanup;
|
||||
}
|
||||
|
||||
ret = _gnutls_privkey_update_spki_params(signer, signer->pk_algorithm,
|
||||
hash_algo, flags, ¶ms);
|
||||
if (ret < 0) {
|
||||
gnutls_assert();
|
||||
- return ret;
|
||||
+ goto cleanup;
|
||||
}
|
||||
|
||||
/* legacy callers of this API could use a hash algorithm of 0 (unknown)
|
||||
@@ -1391,13 +1400,22 @@ gnutls_privkey_sign_hash(gnutls_privkey_t signer,
|
||||
se = _gnutls_pk_to_sign_entry(params.pk, hash_algo);
|
||||
}
|
||||
|
||||
- if (unlikely(se == NULL))
|
||||
- return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
|
||||
+ if (unlikely(se == NULL)) {
|
||||
+ ret = gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
|
||||
+ goto cleanup;
|
||||
+ }
|
||||
|
||||
FIX_SIGN_PARAMS(params, flags, hash_algo);
|
||||
|
||||
- return privkey_sign_prehashed(signer, se,
|
||||
- hash_data, signature, ¶ms);
|
||||
+ ret = privkey_sign_prehashed(signer, se,
|
||||
+ hash_data, signature, ¶ms);
|
||||
+ cleanup:
|
||||
+ if (ret < 0) {
|
||||
+ _gnutls_switch_fips_state(GNUTLS_FIPS140_OP_ERROR);
|
||||
+ } else {
|
||||
+ _gnutls_switch_fips_state(GNUTLS_FIPS140_OP_NOT_APPROVED);
|
||||
+ }
|
||||
+ return ret;
|
||||
}
|
||||
|
||||
static int
|
||||
diff --git a/lib/pubkey.c b/lib/pubkey.c
|
||||
index eba1f5b..35126f3 100644
|
||||
--- a/lib/pubkey.c
|
||||
+++ b/lib/pubkey.c
|
||||
@@ -1985,7 +1985,7 @@ gnutls_pubkey_import_dsa_raw(gnutls_pubkey_t key,
|
||||
* parameters (if any) with the signature algorithm */
|
||||
static
|
||||
int fixup_spki_params(const gnutls_pk_params_st *key_params, const gnutls_sign_entry_st *se,
|
||||
- const mac_entry_st *me, gnutls_x509_spki_st *params)
|
||||
+ const mac_entry_st *me, gnutls_x509_spki_st *params)
|
||||
{
|
||||
unsigned bits;
|
||||
|
||||
@@ -2018,6 +2018,9 @@ int fixup_spki_params(const gnutls_pk_params_st *key_params, const gnutls_sign_e
|
||||
|
||||
if (params->rsa_pss_dig != se->hash)
|
||||
return gnutls_assert_val(GNUTLS_E_CONSTRAINT_ERROR);
|
||||
+ } else if (params->pk == GNUTLS_PK_DSA ||
|
||||
+ params->pk == GNUTLS_PK_ECDSA) {
|
||||
+ params->dsa_dig = se->hash;
|
||||
}
|
||||
|
||||
return 0;
|
||||
diff --git a/tests/fips-test.c b/tests/fips-test.c
|
||||
index 788f4ab..ec0f4b4 100644
|
||||
--- a/tests/fips-test.c
|
||||
+++ b/tests/fips-test.c
|
||||
@@ -80,8 +80,22 @@ static const gnutls_datum_t rsa2342_sha1_sig = {
|
||||
.size = sizeof(rsa2342_sha1_sig_data),
|
||||
};
|
||||
|
||||
+static const uint8_t ecc256_sha1_sig_data[] = {
|
||||
+ 0x30, 0x45, 0x02, 0x21, 0x00, 0x9a, 0x28, 0xc9, 0xbf, 0xc8, 0x70, 0x4f,
|
||||
+ 0x27, 0x2d, 0xe1, 0x66, 0xc4, 0xa5, 0xc6, 0xf2, 0xdc, 0x33, 0xb9, 0x41,
|
||||
+ 0xdf, 0x78, 0x98, 0x8a, 0x22, 0x4d, 0x29, 0x37, 0xa0, 0x0f, 0x6f, 0xd4,
|
||||
+ 0xed, 0x02, 0x20, 0x0b, 0x15, 0xca, 0x30, 0x09, 0x2d, 0x55, 0x44, 0xb4,
|
||||
+ 0x1d, 0x3f, 0x48, 0x7a, 0xc3, 0xd1, 0x2a, 0xc1, 0x0e, 0x47, 0xfa, 0xe6,
|
||||
+ 0xe9, 0x0f, 0x03, 0xe2, 0x01, 0x4e, 0xe4, 0x73, 0x37, 0xa7, 0x90,
|
||||
+};
|
||||
+
|
||||
+static const gnutls_datum_t ecc256_sha1_sig = {
|
||||
+ .data = (unsigned char *)ecc256_sha1_sig_data,
|
||||
+ .size = sizeof(ecc256_sha1_sig_data),
|
||||
+};
|
||||
+
|
||||
static void
|
||||
-rsa_import_keypair(gnutls_privkey_t *privkey, gnutls_pubkey_t *pubkey,
|
||||
+import_keypair(gnutls_privkey_t *privkey, gnutls_pubkey_t *pubkey,
|
||||
const char *filename)
|
||||
{
|
||||
const char *srcdir;
|
||||
@@ -274,6 +288,8 @@ void doit(void)
|
||||
gnutls_datum_t signature;
|
||||
unsigned int bits;
|
||||
uint8_t hmac[64];
|
||||
+ uint8_t hash[64];
|
||||
+ gnutls_datum_t hashed_data;
|
||||
uint8_t pbkdf2[64];
|
||||
gnutls_datum_t temp_key = { NULL, 0 };
|
||||
|
||||
@@ -473,7 +489,7 @@ void doit(void)
|
||||
|
||||
/* Import 2432-bit RSA key; not a security function */
|
||||
FIPS_PUSH_CONTEXT();
|
||||
- rsa_import_keypair(&privkey, &pubkey, "rsa-2432.pem");
|
||||
+ import_keypair(&privkey, &pubkey, "rsa-2432.pem");
|
||||
FIPS_POP_CONTEXT(INITIAL);
|
||||
|
||||
/* Create a signature with 2432-bit RSA and SHA256; approved */
|
||||
@@ -519,7 +535,7 @@ void doit(void)
|
||||
|
||||
/* Import 512-bit RSA key; not a security function */
|
||||
FIPS_PUSH_CONTEXT();
|
||||
- rsa_import_keypair(&privkey, &pubkey, "rsa-512.pem");
|
||||
+ import_keypair(&privkey, &pubkey, "rsa-512.pem");
|
||||
FIPS_POP_CONTEXT(INITIAL);
|
||||
|
||||
/* Create a signature with 512-bit RSA and SHA256; not approved */
|
||||
@@ -543,6 +559,134 @@ void doit(void)
|
||||
gnutls_pubkey_deinit(pubkey);
|
||||
gnutls_privkey_deinit(privkey);
|
||||
|
||||
+ /* Import ECDSA key; not a security function */
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ import_keypair(&privkey, &pubkey, "ecc256.pem");
|
||||
+ FIPS_POP_CONTEXT(INITIAL);
|
||||
+
|
||||
+ /* Create a signature with ECDSA and SHA256; approved */
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ ret = gnutls_privkey_sign_data2(privkey, GNUTLS_SIGN_ECDSA_SHA256, 0,
|
||||
+ &data, &signature);
|
||||
+ if (ret < 0) {
|
||||
+ fail("gnutls_privkey_sign_data2 failed\n");
|
||||
+ }
|
||||
+ FIPS_POP_CONTEXT(APPROVED);
|
||||
+
|
||||
+ /* Verify a signature with ECDSA and SHA256; approved */
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ ret = gnutls_pubkey_verify_data2(pubkey, GNUTLS_SIGN_ECDSA_SHA256, 0,
|
||||
+ &data, &signature);
|
||||
+ if (ret < 0) {
|
||||
+ fail("gnutls_pubkey_verify_data2 failed\n");
|
||||
+ }
|
||||
+ FIPS_POP_CONTEXT(APPROVED);
|
||||
+ gnutls_free(signature.data);
|
||||
+
|
||||
+ /* Create a signature with ECDSA and SHA256 (old API); approved */
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ ret = gnutls_privkey_sign_data(privkey, GNUTLS_DIG_SHA256, 0,
|
||||
+ &data, &signature);
|
||||
+ if (ret < 0) {
|
||||
+ fail("gnutls_privkey_sign_data failed\n");
|
||||
+ }
|
||||
+ FIPS_POP_CONTEXT(APPROVED);
|
||||
+
|
||||
+ /* Create a SHA256 hashed data for 2-pass signature API; not a
|
||||
+ * crypto operation */
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ ret = gnutls_hash_fast(GNUTLS_DIG_SHA256, data.data, data.size, hash);
|
||||
+ if (ret < 0) {
|
||||
+ fail("gnutls_hash_fast failed\n");
|
||||
+ }
|
||||
+ hashed_data.data = hash;
|
||||
+ hashed_data.size = 32;
|
||||
+ FIPS_POP_CONTEXT(INITIAL);
|
||||
+
|
||||
+ /* Create a signature with ECDSA and SHA256 (2-pass API); not-approved */
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ ret = gnutls_privkey_sign_hash2(privkey, GNUTLS_SIGN_ECDSA_SHA256, 0,
|
||||
+ &hashed_data, &signature);
|
||||
+ if (ret < 0) {
|
||||
+ fail("gnutls_privkey_sign_hash2 failed\n");
|
||||
+ }
|
||||
+ FIPS_POP_CONTEXT(NOT_APPROVED);
|
||||
+ gnutls_free(signature.data);
|
||||
+
|
||||
+ /* Create a signature with ECDSA and SHA256 (2-pass old API); not-approved */
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ ret = gnutls_privkey_sign_hash(privkey, GNUTLS_DIG_SHA256, 0,
|
||||
+ &hashed_data, &signature);
|
||||
+ if (ret < 0) {
|
||||
+ fail("gnutls_privkey_sign_hash failed\n");
|
||||
+ }
|
||||
+ FIPS_POP_CONTEXT(NOT_APPROVED);
|
||||
+ gnutls_free(signature.data);
|
||||
+
|
||||
+ /* Create a signature with ECDSA and SHA-1; not approved */
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ ret = gnutls_privkey_sign_data2(privkey, GNUTLS_SIGN_ECDSA_SHA1, 0,
|
||||
+ &data, &signature);
|
||||
+ if (ret < 0) {
|
||||
+ fail("gnutls_privkey_sign_data2 failed\n");
|
||||
+ }
|
||||
+ FIPS_POP_CONTEXT(NOT_APPROVED);
|
||||
+
|
||||
+ /* Verify a signature created with ECDSA and SHA-1; approved */
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ ret = gnutls_pubkey_verify_data2(pubkey, GNUTLS_SIGN_ECDSA_SHA1,
|
||||
+ GNUTLS_VERIFY_ALLOW_SIGN_WITH_SHA1, &data,
|
||||
+ &ecc256_sha1_sig);
|
||||
+ if (ret < 0) {
|
||||
+ fail("gnutls_pubkey_verify_data2 failed\n");
|
||||
+ }
|
||||
+ FIPS_POP_CONTEXT(APPROVED);
|
||||
+ gnutls_free(signature.data);
|
||||
+
|
||||
+ /* Create a signature with ECDSA and SHA-1 (old API); not approved */
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ ret = gnutls_privkey_sign_data(privkey, GNUTLS_DIG_SHA1, 0,
|
||||
+ &data, &signature);
|
||||
+ if (ret < 0) {
|
||||
+ fail("gnutls_privkey_sign_data failed\n");
|
||||
+ }
|
||||
+ FIPS_POP_CONTEXT(NOT_APPROVED);
|
||||
+ gnutls_free(signature.data);
|
||||
+
|
||||
+ /* Create a SHA1 hashed data for 2-pass signature API; not a
|
||||
+ * crypto operation */
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ ret = gnutls_hash_fast(GNUTLS_DIG_SHA1, data.data, data.size, hash);
|
||||
+ if (ret < 0) {
|
||||
+ fail("gnutls_hash_fast failed\n");
|
||||
+ }
|
||||
+ hashed_data.data = hash;
|
||||
+ hashed_data.size = 20;
|
||||
+ FIPS_POP_CONTEXT(INITIAL);
|
||||
+
|
||||
+ /* Create a signature with ECDSA and SHA1 (2-pass API); not-approved */
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ ret = gnutls_privkey_sign_hash2(privkey, GNUTLS_SIGN_ECDSA_SHA1, 0,
|
||||
+ &hashed_data, &signature);
|
||||
+ if (ret < 0) {
|
||||
+ fail("gnutls_privkey_sign_hash2 failed\n");
|
||||
+ }
|
||||
+ FIPS_POP_CONTEXT(NOT_APPROVED);
|
||||
+ gnutls_free(signature.data);
|
||||
+
|
||||
+ /* Create a signature with ECDSA and SHA1 (2-pass old API); not-approved */
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ ret = gnutls_privkey_sign_hash(privkey, GNUTLS_DIG_SHA1, 0,
|
||||
+ &hashed_data, &signature);
|
||||
+ if (ret < 0) {
|
||||
+ fail("gnutls_privkey_sign_hash failed\n");
|
||||
+ }
|
||||
+ FIPS_POP_CONTEXT(NOT_APPROVED);
|
||||
+ gnutls_free(signature.data);
|
||||
+
|
||||
+ gnutls_pubkey_deinit(pubkey);
|
||||
+ gnutls_privkey_deinit(privkey);
|
||||
+
|
||||
/* Test RND functions */
|
||||
FIPS_PUSH_CONTEXT();
|
||||
ret = gnutls_rnd(GNUTLS_RND_RANDOM, key16, sizeof(key16));
|
||||
--
|
||||
2.37.3
|
||||
|
|
@ -1,805 +0,0 @@
|
|||
From 4751e1e2d4012404af9bc52535aa73ac88bc7bea Mon Sep 17 00:00:00 2001
|
||||
From: rpm-build <rpm-build>
|
||||
Date: Thu, 13 Jul 2023 16:14:08 +0200
|
||||
Subject: [PATCH] gnutls-3.7.6-fips-ems.patch
|
||||
|
||||
---
|
||||
doc/cha-gtls-app.texi | 5 +
|
||||
lib/gnutls_int.h | 6 +
|
||||
lib/handshake.c | 35 ++++-
|
||||
lib/nettle/int/tls1-prf.c | 19 +++
|
||||
lib/priority.c | 41 +++++
|
||||
lib/priority_options.gperf | 1 +
|
||||
tests/Makefile.am | 4 +-
|
||||
tests/multi-alerts.c | 8 +
|
||||
tests/no-extensions.c | 7 +
|
||||
.../ocsp-tests/ocsp-must-staple-connection.sh | 60 +++----
|
||||
tests/rehandshake-ext-secret.c | 8 +
|
||||
tests/resume.c | 26 ++-
|
||||
tests/status-request.c | 8 +-
|
||||
tests/system-override-session-hash.sh | 144 +++++++++++++++++
|
||||
tests/tls-force-ems.c | 148 ++++++++++++++++++
|
||||
15 files changed, 477 insertions(+), 43 deletions(-)
|
||||
create mode 100755 tests/system-override-session-hash.sh
|
||||
create mode 100644 tests/tls-force-ems.c
|
||||
|
||||
diff --git a/doc/cha-gtls-app.texi b/doc/cha-gtls-app.texi
|
||||
index bd44478..57e7d50 100644
|
||||
--- a/doc/cha-gtls-app.texi
|
||||
+++ b/doc/cha-gtls-app.texi
|
||||
@@ -1547,6 +1547,11 @@ This is implied by the PFS keyword.
|
||||
will prevent the advertizing the TLS extended master secret (session hash)
|
||||
extension.
|
||||
|
||||
+@item %FORCE_SESSION_HASH @tab
|
||||
+negotiate the TLS extended master secret (session hash) extension.
|
||||
+Specifying both %NO_SESSION_HASH and %FORCE_SESSION_HASH is not
|
||||
+supported, and the behavior is undefined.
|
||||
+
|
||||
@item %SERVER_PRECEDENCE @tab
|
||||
The ciphersuite will be selected according to server priorities
|
||||
and not the client's.
|
||||
diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h
|
||||
index 8c7bdaa..c6bf154 100644
|
||||
--- a/lib/gnutls_int.h
|
||||
+++ b/lib/gnutls_int.h
|
||||
@@ -926,6 +926,11 @@ typedef struct sign_algo_list_st {
|
||||
|
||||
#include "atomic.h"
|
||||
|
||||
+typedef enum ext_master_secret_t {
|
||||
+ EMS_REQUEST,
|
||||
+ EMS_REQUIRE
|
||||
+} ext_master_secret_t;
|
||||
+
|
||||
/* For the external api */
|
||||
struct gnutls_priority_st {
|
||||
priority_st protocol;
|
||||
@@ -965,6 +970,7 @@ struct gnutls_priority_st {
|
||||
bool force_etm;
|
||||
unsigned int additional_verify_flags;
|
||||
bool tls13_compat_mode;
|
||||
+ ext_master_secret_t force_ext_master_secret;
|
||||
|
||||
/* TLS_FALLBACK_SCSV */
|
||||
bool fallback;
|
||||
diff --git a/lib/handshake.c b/lib/handshake.c
|
||||
index 21edc5e..1e33b84 100644
|
||||
--- a/lib/handshake.c
|
||||
+++ b/lib/handshake.c
|
||||
@@ -875,6 +875,15 @@ read_client_hello(gnutls_session_t session, uint8_t * data,
|
||||
if (_gnutls_version_priority(session, vers->id) < 0)
|
||||
return gnutls_assert_val(GNUTLS_E_UNSUPPORTED_VERSION_PACKET);
|
||||
|
||||
+ /* check if EMS is required */
|
||||
+ if (!vers->tls13_sem && vers->id != GNUTLS_SSL3 &&
|
||||
+ vers->id != GNUTLS_DTLS0_9 &&
|
||||
+ session->internals.priorities->force_ext_master_secret ==
|
||||
+ EMS_REQUIRE &&
|
||||
+ !session->security_parameters.ext_master_secret) {
|
||||
+ return gnutls_assert_val(GNUTLS_E_INSUFFICIENT_SECURITY);
|
||||
+ }
|
||||
+
|
||||
_gnutls_handshake_log("HSK[%p]: Selected version %s\n", session, vers->name);
|
||||
|
||||
/* select appropriate compression method */
|
||||
@@ -2062,11 +2071,27 @@ read_server_hello(gnutls_session_t session,
|
||||
if (ret < 0)
|
||||
return gnutls_assert_val(ret);
|
||||
|
||||
- /* check if EtM is required */
|
||||
- if (!vers->tls13_sem && session->internals.priorities->force_etm && !session->security_parameters.etm) {
|
||||
- const cipher_entry_st *cipher = cipher_to_entry(session->security_parameters.cs->block_algorithm);
|
||||
- if (_gnutls_cipher_type(cipher) == CIPHER_BLOCK)
|
||||
- return gnutls_assert_val(GNUTLS_E_UNWANTED_ALGORITHM);
|
||||
+ if (!vers->tls13_sem) {
|
||||
+ /* check if EtM is required */
|
||||
+ if (session->internals.priorities->force_etm &&
|
||||
+ !session->security_parameters.etm) {
|
||||
+ const cipher_entry_st *cipher =
|
||||
+ cipher_to_entry(session->security_parameters.
|
||||
+ cs->block_algorithm);
|
||||
+ if (_gnutls_cipher_type(cipher) == CIPHER_BLOCK)
|
||||
+ return
|
||||
+ gnutls_assert_val
|
||||
+ (GNUTLS_E_UNWANTED_ALGORITHM);
|
||||
+ }
|
||||
+
|
||||
+ /* check if EMS is required */
|
||||
+ if (vers->id != GNUTLS_SSL3 && vers->id != GNUTLS_DTLS0_9 &&
|
||||
+ session->internals.priorities->force_ext_master_secret ==
|
||||
+ EMS_REQUIRE &&
|
||||
+ !session->security_parameters.ext_master_secret) {
|
||||
+ return
|
||||
+ gnutls_assert_val(GNUTLS_E_INSUFFICIENT_SECURITY);
|
||||
+ }
|
||||
}
|
||||
|
||||
|
||||
diff --git a/lib/nettle/int/tls1-prf.c b/lib/nettle/int/tls1-prf.c
|
||||
index 19ca5d3..fd9b5a4 100644
|
||||
--- a/lib/nettle/int/tls1-prf.c
|
||||
+++ b/lib/nettle/int/tls1-prf.c
|
||||
@@ -28,6 +28,7 @@
|
||||
#endif
|
||||
|
||||
#include <gnutls_int.h>
|
||||
+#include "fips.h"
|
||||
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
@@ -152,8 +153,26 @@ tls12_prf(void *mac_ctx,
|
||||
size_t seed_size, const uint8_t *seed,
|
||||
size_t length, uint8_t *dst)
|
||||
{
|
||||
+#define MASTER_SECRET "master secret"
|
||||
+#define MASTER_SECRET_SIZE (sizeof(MASTER_SECRET) - 1)
|
||||
+
|
||||
P_hash(mac_ctx, update, digest, digest_size,
|
||||
seed_size, seed, label_size, label, length, dst);
|
||||
|
||||
+ /* Since May 16, 2023, the use of extended master secret is
|
||||
+ * mandatory according to FIPS 140-3 IG D.Q. Instead of
|
||||
+ * allowing the "extended master secret" label specifically,
|
||||
+ * we mark the use of non-EMS label, i.e., "master secret" as
|
||||
+ * non-approved, because it is still useful to call the
|
||||
+ * gnutls_prf_raw function with arbitrary label, e.g., in
|
||||
+ * self-tests.
|
||||
+ */
|
||||
+ if (label_size == MASTER_SECRET_SIZE &&
|
||||
+ memcmp(label, MASTER_SECRET, MASTER_SECRET_SIZE) == 0) {
|
||||
+ _gnutls_switch_fips_state(GNUTLS_FIPS140_OP_NOT_APPROVED);
|
||||
+ } else {
|
||||
+ _gnutls_switch_fips_state(GNUTLS_FIPS140_OP_APPROVED);
|
||||
+ }
|
||||
+
|
||||
return 1;
|
||||
}
|
||||
diff --git a/lib/priority.c b/lib/priority.c
|
||||
index d163d81..4adf4c7 100644
|
||||
--- a/lib/priority.c
|
||||
+++ b/lib/priority.c
|
||||
@@ -906,6 +906,12 @@ static void enable_no_ext_master_secret(gnutls_priority_t c)
|
||||
{
|
||||
c->_no_ext_master_secret = 1;
|
||||
}
|
||||
+
|
||||
+static void enable_force_ext_master_secret(gnutls_priority_t c)
|
||||
+{
|
||||
+ c->force_ext_master_secret = EMS_REQUIRE;
|
||||
+}
|
||||
+
|
||||
static void enable_no_etm(gnutls_priority_t c)
|
||||
{
|
||||
c->_no_etm = 1;
|
||||
@@ -1040,6 +1046,9 @@ struct cfg {
|
||||
gnutls_kx_algorithm_t kxs[MAX_ALGOS+1];
|
||||
gnutls_sign_algorithm_t sigs[MAX_ALGOS+1];
|
||||
gnutls_protocol_t versions[MAX_ALGOS+1];
|
||||
+
|
||||
+ ext_master_secret_t force_ext_master_secret;
|
||||
+ bool force_ext_master_secret_set;
|
||||
};
|
||||
|
||||
static inline void
|
||||
@@ -1141,6 +1150,8 @@ cfg_steal(struct cfg *dst, struct cfg *src)
|
||||
|
||||
dst->allowlisting = src->allowlisting;
|
||||
dst->ktls_enabled = src->ktls_enabled;
|
||||
+ dst->force_ext_master_secret = src->force_ext_master_secret;
|
||||
+ dst->force_ext_master_secret_set = src->force_ext_master_secret_set;
|
||||
memcpy(dst->ciphers, src->ciphers, sizeof(src->ciphers));
|
||||
memcpy(dst->macs, src->macs, sizeof(src->macs));
|
||||
memcpy(dst->groups, src->groups, sizeof(src->groups));
|
||||
@@ -1748,6 +1759,21 @@ static int cfg_ini_handler(void *_ctx, const char *section, const char *name, co
|
||||
}
|
||||
cfg->kxs[i] = algo;
|
||||
cfg->kxs[i+1] = 0;
|
||||
+ } else if (c_strcasecmp(name, "tls-session-hash") == 0) {
|
||||
+ if (c_strcasecmp(value, "request") == 0) {
|
||||
+ cfg->force_ext_master_secret = EMS_REQUEST;
|
||||
+ cfg->force_ext_master_secret_set = true;
|
||||
+ } else if (c_strcasecmp(value, "require") == 0) {
|
||||
+ cfg->force_ext_master_secret = EMS_REQUIRE;
|
||||
+ cfg->force_ext_master_secret_set = true;
|
||||
+ } else {
|
||||
+ _gnutls_debug_log(
|
||||
+ "cfg: unknown value for %s: %s\n", name,
|
||||
+ value);
|
||||
+ if (fail_on_invalid_config)
|
||||
+ return 0;
|
||||
+ goto exit;
|
||||
+ }
|
||||
} else {
|
||||
_gnutls_debug_log("unknown parameter %s\n", name);
|
||||
if (fail_on_invalid_config)
|
||||
@@ -2744,6 +2770,12 @@ gnutls_priority_init(gnutls_priority_t * priority_cache,
|
||||
(*priority_cache)->min_record_version = 1;
|
||||
gnutls_atomic_init(&(*priority_cache)->usage_cnt);
|
||||
|
||||
+ if (_gnutls_fips_mode_enabled()) {
|
||||
+ (*priority_cache)->force_ext_master_secret = EMS_REQUIRE;
|
||||
+ } else {
|
||||
+ (*priority_cache)->force_ext_master_secret = EMS_REQUEST;
|
||||
+ }
|
||||
+
|
||||
if (system_wide_config.allowlisting && !priorities) {
|
||||
priorities = "@" LEVEL_SYSTEM;
|
||||
}
|
||||
@@ -2997,6 +3029,15 @@ gnutls_priority_init(gnutls_priority_t * priority_cache,
|
||||
goto error;
|
||||
}
|
||||
|
||||
+ /* This needs to be done after parsing modifiers, as
|
||||
+ * tls-session-hash has precedence over modifiers.
|
||||
+ */
|
||||
+ if (system_wide_config.force_ext_master_secret_set) {
|
||||
+ (*priority_cache)->force_ext_master_secret =
|
||||
+ system_wide_config.force_ext_master_secret;
|
||||
+ (*priority_cache)->_no_ext_master_secret = false;
|
||||
+ }
|
||||
+
|
||||
ret = set_ciphersuite_list(*priority_cache);
|
||||
if (ret < 0) {
|
||||
if (err_pos)
|
||||
diff --git a/lib/priority_options.gperf b/lib/priority_options.gperf
|
||||
index 5a041b7..5bb250a 100644
|
||||
--- a/lib/priority_options.gperf
|
||||
+++ b/lib/priority_options.gperf
|
||||
@@ -13,6 +13,7 @@ NO_TICKETS_TLS12, enable_no_tickets_tls12
|
||||
NO_ETM, enable_no_etm
|
||||
FORCE_ETM, enable_force_etm
|
||||
NO_SESSION_HASH, enable_no_ext_master_secret
|
||||
+FORCE_SESSION_HASH, enable_force_ext_master_secret
|
||||
STATELESS_COMPRESSION, dummy_func
|
||||
VERIFY_ALLOW_BROKEN, enable_verify_allow_broken
|
||||
VERIFY_ALLOW_SIGN_RSA_MD5, enable_verify_allow_rsa_md5
|
||||
diff --git a/tests/Makefile.am b/tests/Makefile.am
|
||||
index 23d309d..e5f7fa6 100644
|
||||
--- a/tests/Makefile.am
|
||||
+++ b/tests/Makefile.am
|
||||
@@ -77,7 +77,7 @@ EXTRA_DIST = suppressions.valgrind eagain-common.h cert-common.h test-chains.h \
|
||||
testpkcs11-certs/client.key testpkcs11-certs/server.crt testpkcs11-certs/server-tmpl \
|
||||
testpkcs11-certs/ca.key testpkcs11-certs/client.crt testpkcs11-certs/client-tmpl testpkcs11-certs/server.key \
|
||||
crt_type-neg-common.c \
|
||||
- system-override-default-priority-string.bad.config system-override-default-priority-string.none.config system-override-default-priority-string.only-tls13.config \
|
||||
+ system-override-default-priority-string.bad.config system-override-default-priority-string.none.config system-override-default-priority-string.only-tls13.config system-override-session-hash.sh \
|
||||
client-secrets.h server-secrets.h
|
||||
|
||||
AM_CFLAGS = $(WARN_CFLAGS) $(WERROR_CFLAGS)
|
||||
@@ -234,7 +234,7 @@ ctests += mini-record-2 simple gnutls_hmac_fast set_pkcs12_cred cert certuniquei
|
||||
set_x509_ocsp_multi_cli kdf-api keylog-func handshake-write \
|
||||
x509cert-dntypes id-on-xmppAddr tls13-compat-mode ciphersuite-name \
|
||||
x509-upnconstraint cipher-padding xts-key-check pkcs7-verify-double-free \
|
||||
- fips-rsa-sizes tls12-rehandshake-ticket
|
||||
+ fips-rsa-sizes tls12-rehandshake-ticket tls-force-ems
|
||||
|
||||
ctests += tls-channel-binding
|
||||
|
||||
diff --git a/tests/multi-alerts.c b/tests/multi-alerts.c
|
||||
index 84a412c..27be63b 100644
|
||||
--- a/tests/multi-alerts.c
|
||||
+++ b/tests/multi-alerts.c
|
||||
@@ -198,6 +198,14 @@ void doit(void)
|
||||
int sockets[2];
|
||||
int err;
|
||||
|
||||
+ /* This test does not work under FIPS, as extended master
|
||||
+ * secret extension needs to be negotiated through extensions,
|
||||
+ * but the fixture does not contain the extension.
|
||||
+ */
|
||||
+ if (gnutls_fips140_mode_enabled()) {
|
||||
+ exit(77);
|
||||
+ }
|
||||
+
|
||||
err = socketpair(AF_UNIX, SOCK_STREAM, 0, sockets);
|
||||
if (err == -1) {
|
||||
perror("socketpair");
|
||||
diff --git a/tests/no-extensions.c b/tests/no-extensions.c
|
||||
index 3bd9d06..e5b9578 100644
|
||||
--- a/tests/no-extensions.c
|
||||
+++ b/tests/no-extensions.c
|
||||
@@ -205,6 +205,13 @@ void start(const char *prio, gnutls_protocol_t exp_version)
|
||||
|
||||
void doit(void)
|
||||
{
|
||||
+ /* This test does not work under FIPS, as extended master
|
||||
+ * secret extension needs to be negotiated through extensions.
|
||||
+ */
|
||||
+ if (gnutls_fips140_mode_enabled()) {
|
||||
+ exit(77);
|
||||
+ }
|
||||
+
|
||||
start("NORMAL:-VERS-ALL:+VERS-TLS1.0:%NO_EXTENSIONS", GNUTLS_TLS1_0);
|
||||
start("NORMAL:-VERS-ALL:+VERS-TLS1.1:%NO_EXTENSIONS", GNUTLS_TLS1_1);
|
||||
start("NORMAL:-VERS-ALL:+VERS-TLS1.2:%NO_EXTENSIONS", GNUTLS_TLS1_2);
|
||||
diff --git a/tests/ocsp-tests/ocsp-must-staple-connection.sh b/tests/ocsp-tests/ocsp-must-staple-connection.sh
|
||||
index 049491a..594e854 100755
|
||||
--- a/tests/ocsp-tests/ocsp-must-staple-connection.sh
|
||||
+++ b/tests/ocsp-tests/ocsp-must-staple-connection.sh
|
||||
@@ -402,39 +402,43 @@ kill "${TLS_SERVER_PID}"
|
||||
wait "${TLS_SERVER_PID}"
|
||||
unset TLS_SERVER_PID
|
||||
|
||||
-echo "=== Test 7: OSCP response error - client doesn't send status_request ==="
|
||||
-
|
||||
-eval "${GETPORT}"
|
||||
-# Port for gnutls-serv
|
||||
-TLS_SERVER_PORT=$PORT
|
||||
-PORT=${TLS_SERVER_PORT}
|
||||
-launch_bare_server \
|
||||
- datefudge "${TESTDATE}" \
|
||||
- "${SERV}" --echo --disable-client-cert \
|
||||
- --x509keyfile="${srcdir}/ocsp-tests/certs/server_good.key" \
|
||||
- --x509certfile="${SERVER_CERT_FILE}" \
|
||||
- --port="${TLS_SERVER_PORT}" \
|
||||
- --ocsp-response="${srcdir}/ocsp-tests/response3.der" --ignore-ocsp-response-errors
|
||||
-TLS_SERVER_PID="${!}"
|
||||
-wait_server $TLS_SERVER_PID
|
||||
+if test "${GNUTLS_FORCE_FIPS_MODE}" != 1; then
|
||||
+
|
||||
+ echo "=== Test 7: OSCP response error - client doesn't send status_request ==="
|
||||
+
|
||||
+ eval "${GETPORT}"
|
||||
+ # Port for gnutls-serv
|
||||
+ TLS_SERVER_PORT=$PORT
|
||||
+ PORT=${TLS_SERVER_PORT}
|
||||
+ launch_bare_server \
|
||||
+ datefudge "${TESTDATE}" \
|
||||
+ "${SERV}" --echo --disable-client-cert \
|
||||
+ --x509keyfile="${srcdir}/ocsp-tests/certs/server_good.key" \
|
||||
+ --x509certfile="${SERVER_CERT_FILE}" \
|
||||
+ --port="${TLS_SERVER_PORT}" \
|
||||
+ --ocsp-response="${srcdir}/ocsp-tests/response3.der" --ignore-ocsp-response-errors
|
||||
+ TLS_SERVER_PID="${!}"
|
||||
+ wait_server $TLS_SERVER_PID
|
||||
+
|
||||
+ wait_for_port "${TLS_SERVER_PORT}"
|
||||
+
|
||||
+ echo "test 123456" | \
|
||||
+ datefudge -s "${TESTDATE}" \
|
||||
+ "${CLI}" --priority "NORMAL:%NO_EXTENSIONS" --ocsp --x509cafile="${srcdir}/ocsp-tests/certs/ca.pem" \
|
||||
+ --port="${TLS_SERVER_PORT}" localhost
|
||||
+ rc=$?
|
||||
|
||||
-wait_for_port "${TLS_SERVER_PORT}"
|
||||
+ if test "${rc}" != "0"; then
|
||||
+ echo "Connecting to server with valid certificate and OCSP error response failed"
|
||||
+ exit ${rc}
|
||||
+ fi
|
||||
|
||||
-echo "test 123456" | \
|
||||
- datefudge -s "${TESTDATE}" \
|
||||
- "${CLI}" --priority "NORMAL:%NO_EXTENSIONS" --ocsp --x509cafile="${srcdir}/ocsp-tests/certs/ca.pem" \
|
||||
- --port="${TLS_SERVER_PORT}" localhost
|
||||
-rc=$?
|
||||
+ kill "${TLS_SERVER_PID}"
|
||||
+ wait "${TLS_SERVER_PID}"
|
||||
+ unset TLS_SERVER_PID
|
||||
|
||||
-if test "${rc}" != "0"; then
|
||||
- echo "Connecting to server with valid certificate and OCSP error response failed"
|
||||
- exit ${rc}
|
||||
fi
|
||||
|
||||
-kill "${TLS_SERVER_PID}"
|
||||
-wait "${TLS_SERVER_PID}"
|
||||
-unset TLS_SERVER_PID
|
||||
-
|
||||
echo "=== Test 8: OSCP response error - client sends status_request, no TLS feature extension ==="
|
||||
|
||||
eval "${GETPORT}"
|
||||
diff --git a/tests/rehandshake-ext-secret.c b/tests/rehandshake-ext-secret.c
|
||||
index 94279f0..8d68c9b 100644
|
||||
--- a/tests/rehandshake-ext-secret.c
|
||||
+++ b/tests/rehandshake-ext-secret.c
|
||||
@@ -142,6 +142,14 @@ static void try(unsigned onclient)
|
||||
|
||||
void doit(void)
|
||||
{
|
||||
+ /* This test does not work with TLS 1.2 under FIPS, as
|
||||
+ * extended master secret extension needs to be negotiated
|
||||
+ * through extensions, while %NO_SESSION_HASH is set.
|
||||
+ */
|
||||
+ if (gnutls_fips140_mode_enabled()) {
|
||||
+ exit(77);
|
||||
+ }
|
||||
+
|
||||
try(0);
|
||||
reset_buffers();
|
||||
try(1);
|
||||
diff --git a/tests/resume.c b/tests/resume.c
|
||||
index 93838c0..aa3c60c 100644
|
||||
--- a/tests/resume.c
|
||||
+++ b/tests/resume.c
|
||||
@@ -91,6 +91,7 @@ struct params_res {
|
||||
int change_ciphersuite;
|
||||
int early_start;
|
||||
int no_early_start;
|
||||
+ int no_fips;
|
||||
};
|
||||
|
||||
pid_t child;
|
||||
@@ -126,16 +127,18 @@ struct params_res resume_tests[] = {
|
||||
.enable_session_ticket_client = ST_NONE,
|
||||
.expect_resume = 0,
|
||||
.first_no_ext_master = 0,
|
||||
- .second_no_ext_master = 1},
|
||||
+ .second_no_ext_master = 1,
|
||||
+ .no_fips = 1},
|
||||
{.desc = "try to resume from db (none -> ext master secret)",
|
||||
.enable_db = 1,
|
||||
.enable_session_ticket_server = ST_NONE,
|
||||
.enable_session_ticket_client = ST_NONE,
|
||||
.expect_resume = 0,
|
||||
.first_no_ext_master = 1,
|
||||
- .second_no_ext_master = 0},
|
||||
-#endif
|
||||
-#if defined(TLS13)
|
||||
+ .second_no_ext_master = 0,
|
||||
+ .no_fips = 1},
|
||||
+# endif
|
||||
+# if defined(TLS13)
|
||||
/* only makes sense under TLS1.3 as negotiation involves a new
|
||||
* handshake with different parameters */
|
||||
{.desc = "try to resume from session ticket (different cipher order)",
|
||||
@@ -211,14 +214,17 @@ struct params_res resume_tests[] = {
|
||||
.enable_session_ticket_client = ST_ALL,
|
||||
.expect_resume = 0,
|
||||
.first_no_ext_master = 0,
|
||||
- .second_no_ext_master = 1},
|
||||
- {.desc = "try to resume from session ticket (none -> ext master secret)",
|
||||
+ .second_no_ext_master = 1,
|
||||
+ .no_fips = 1},
|
||||
+ {.desc =
|
||||
+ "try to resume from session ticket (none -> ext master secret)",
|
||||
.enable_db = 0,
|
||||
.enable_session_ticket_server = ST_ALL,
|
||||
.enable_session_ticket_client = ST_ALL,
|
||||
.expect_resume = 0,
|
||||
.first_no_ext_master = 1,
|
||||
- .second_no_ext_master = 0},
|
||||
+ .second_no_ext_master = 0,
|
||||
+ .no_fips = 1},
|
||||
{.desc = "try to resume from session ticket (server only)",
|
||||
.enable_db = 0,
|
||||
.enable_session_ticket_server = ST_ALL,
|
||||
@@ -942,6 +948,12 @@ void doit(void)
|
||||
int client_sds[SESSIONS], server_sds[SESSIONS];
|
||||
int j;
|
||||
|
||||
+ if (resume_tests[i].no_fips && gnutls_fips140_mode_enabled()) {
|
||||
+ success("skipping %s under FIPS mode\n",
|
||||
+ resume_tests[i].desc);
|
||||
+ continue;
|
||||
+ }
|
||||
+
|
||||
printf("%s\n", resume_tests[i].desc);
|
||||
|
||||
for (j = 0; j < SESSIONS; j++) {
|
||||
diff --git a/tests/status-request.c b/tests/status-request.c
|
||||
index 07c7918..cd2cc54 100644
|
||||
--- a/tests/status-request.c
|
||||
+++ b/tests/status-request.c
|
||||
@@ -289,7 +289,13 @@ void start(const char *prio)
|
||||
|
||||
void doit(void)
|
||||
{
|
||||
- start("NORMAL:-VERS-ALL:+VERS-TLS1.2");
|
||||
+ /* This test does not work with TLS 1.2 under FIPS, as
|
||||
+ * extended master secret extension needs to be negotiated
|
||||
+ * through extensions.
|
||||
+ */
|
||||
+ if (!gnutls_fips140_mode_enabled()) {
|
||||
+ start("NORMAL:-VERS-ALL:+VERS-TLS1.2");
|
||||
+ }
|
||||
start("NORMAL:-VERS-ALL:+VERS-TLS1.3");
|
||||
start("NORMAL");
|
||||
}
|
||||
diff --git a/tests/system-override-session-hash.sh b/tests/system-override-session-hash.sh
|
||||
new file mode 100755
|
||||
index 0000000..97f11fa
|
||||
--- /dev/null
|
||||
+++ b/tests/system-override-session-hash.sh
|
||||
@@ -0,0 +1,144 @@
|
||||
+#!/bin/sh
|
||||
+
|
||||
+# Copyright (C) 2021 Red Hat, Inc.
|
||||
+#
|
||||
+# Author: Alexander Sosedkin
|
||||
+#
|
||||
+# This file is part of GnuTLS.
|
||||
+#
|
||||
+# GnuTLS is free software; you can redistribute it and/or modify it
|
||||
+# under the terms of the GNU General Public License as published by the
|
||||
+# Free Software Foundation; either version 3 of the License, or (at
|
||||
+# your option) any later version.
|
||||
+#
|
||||
+# GnuTLS is distributed in the hope that it will be useful, but
|
||||
+# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
+# General Public License for more details.
|
||||
+#
|
||||
+# You should have received a copy of the GNU General Public License
|
||||
+# along with GnuTLS. If not, see <https://www.gnu.org/licenses/>.
|
||||
+
|
||||
+: ${srcdir=.}
|
||||
+: ${SERV=../src/gnutls-serv${EXEEXT}}
|
||||
+: ${CLI=../src/gnutls-cli${EXEEXT}}
|
||||
+
|
||||
+if ! test -x "${SERV}"; then
|
||||
+ exit 77
|
||||
+fi
|
||||
+
|
||||
+if ! test -x "${CLI}"; then
|
||||
+ exit 77
|
||||
+fi
|
||||
+
|
||||
+${CLI} --fips140-mode
|
||||
+if test $? = 0;then
|
||||
+ echo "Cannot run this test in FIPS140 mode"
|
||||
+ exit 77
|
||||
+fi
|
||||
+
|
||||
+. "${srcdir}/scripts/common.sh"
|
||||
+
|
||||
+testdir=`create_testdir cfg`
|
||||
+
|
||||
+cat <<_EOF_ > "$testdir/request.cfg"
|
||||
+[overrides]
|
||||
+
|
||||
+tls-session-hash = request
|
||||
+_EOF_
|
||||
+
|
||||
+cat <<_EOF_ > "$testdir/require.cfg"
|
||||
+[overrides]
|
||||
+
|
||||
+tls-session-hash = require
|
||||
+_EOF_
|
||||
+
|
||||
+eval "${GETPORT}"
|
||||
+
|
||||
+KEY=${srcdir}/../doc/credentials/x509/key-rsa-pss.pem
|
||||
+CERT=${srcdir}/../doc/credentials/x509/cert-rsa-pss.pem
|
||||
+CA=${srcdir}/../doc/credentials/x509/ca.pem
|
||||
+
|
||||
+unset GNUTLS_SYSTEM_PRIORITY_FILE
|
||||
+unset GNUTLS_DEBUG_LEVEL
|
||||
+
|
||||
+launch_server --echo --priority "NORMAL:-VERS-ALL:+VERS-TLS1.2" --x509keyfile ${KEY} --x509certfile ${CERT}
|
||||
+PID=$!
|
||||
+wait_server ${PID}
|
||||
+
|
||||
+export GNUTLS_SYSTEM_PRIORITY_FILE="$testdir/request.cfg"
|
||||
+export GNUTLS_DEBUG_LEVEL=3
|
||||
+
|
||||
+"${CLI}" -p "${PORT}" 127.0.0.1 --priority "NORMAL:-VERS-ALL:+VERS-TLS1.2" --verify-hostname=localhost --x509cafile ${CA} --logfile="$testdir/client.log" </dev/null >/dev/null ||
|
||||
+ fail "expected connection to succeed (1)"
|
||||
+
|
||||
+# "tls-session-hash" has precedence over %FORCE_SESSION_HASH
|
||||
+"${CLI}" -p "${PORT}" 127.0.0.1 --priority "NORMAL:-VERS-ALL:+VERS-TLS1.2:%FORCE_SESSION_HASH" --verify-hostname=localhost --x509cafile ${CA} --logfile="$testdir/client.log" </dev/null >/dev/null ||
|
||||
+ fail "expected connection to succeed (2)"
|
||||
+
|
||||
+echo kill ${PID}
|
||||
+kill ${PID}
|
||||
+wait
|
||||
+
|
||||
+unset GNUTLS_SYSTEM_PRIORITY_FILE
|
||||
+unset GNUTLS_DEBUG_LEVEL
|
||||
+
|
||||
+export GNUTLS_SYSTEM_PRIORITY_FILE="$testdir/request.cfg"
|
||||
+
|
||||
+# "tls-session-hash" has precedence over %FORCE_SESSION_HASH
|
||||
+launch_server --echo --priority "NORMAL:-VERS-ALL:+VERS-TLS1.2:%FORCE_SESSION_HASH" --x509keyfile ${KEY} --x509certfile ${CERT}
|
||||
+PID=$!
|
||||
+wait_server ${PID}
|
||||
+
|
||||
+export GNUTLS_DEBUG_LEVEL=3
|
||||
+
|
||||
+"${CLI}" -p "${PORT}" 127.0.0.1 --priority "NORMAL:-VERS-ALL:+VERS-TLS1.2" --verify-hostname=localhost --x509cafile ${CA} --logfile="$testdir/client.log" </dev/null >/dev/null ||
|
||||
+ fail ${PID} "expected connection to succeed (3)"
|
||||
+
|
||||
+"${CLI}" -p "${PORT}" 127.0.0.1 --priority "NORMAL:-VERS-ALL:+VERS-TLS1.2:%NO_SESSION_HASH" --verify-hostname=localhost --x509cafile ${CA} --logfile="$testdir/client.log" </dev/null >/dev/null ||
|
||||
+ fail ${PID} "expected connection to succeed (4)"
|
||||
+
|
||||
+kill ${PID}
|
||||
+wait
|
||||
+
|
||||
+unset GNUTLS_SYSTEM_PRIORITY_FILE
|
||||
+unset GNUTLS_DEBUG_LEVEL
|
||||
+
|
||||
+launch_server --echo --priority "NORMAL:-VERS-ALL:+VERS-TLS1.2" --x509keyfile ${KEY} --x509certfile ${CERT}
|
||||
+PID=$!
|
||||
+wait_server ${PID}
|
||||
+
|
||||
+export GNUTLS_SYSTEM_PRIORITY_FILE="$testdir/require.cfg"
|
||||
+export GNUTLS_DEBUG_LEVEL=3
|
||||
+
|
||||
+"${CLI}" -p "${PORT}" 127.0.0.1 --priority "NORMAL:-VERS-ALL:+VERS-TLS1.2" --verify-hostname=localhost --x509cafile ${CA} --logfile="$testdir/client.log" </dev/null >/dev/null ||
|
||||
+ fail ${PID} "expected connection to succeed (5)"
|
||||
+
|
||||
+# "tls-session-hash" has precedence over %NO_SESSION_HASH
|
||||
+"${CLI}" -p "${PORT}" 127.0.0.1 --priority "NORMAL:-VERS-ALL:+VERS-TLS1.2:%NO_SESSION_HASH" --verify-hostname=localhost --x509cafile ${CA} --logfile="$testdir/client.log" </dev/null >/dev/null ||
|
||||
+ fail ${PID} "expected connection to succeed (6)"
|
||||
+
|
||||
+kill ${PID}
|
||||
+wait
|
||||
+
|
||||
+unset GNUTLS_SYSTEM_PRIORITY_FILE
|
||||
+unset GNUTLS_DEBUG_LEVEL
|
||||
+
|
||||
+export GNUTLS_SYSTEM_PRIORITY_FILE="$testdir/require.cfg"
|
||||
+
|
||||
+# "tls-session-hash" has precedence over %NO_SESSION_HASH
|
||||
+launch_server --echo --priority "NORMAL:-VERS-ALL:+VERS-TLS1.2:%NO_SESSION_HASH" --x509keyfile ${KEY} --x509certfile ${CERT}
|
||||
+PID=$!
|
||||
+wait_server ${PID}
|
||||
+
|
||||
+"${CLI}" -p "${PORT}" 127.0.0.1 --priority "NORMAL:-VERS-ALL:+VERS-TLS1.2" --verify-hostname=localhost --x509cafile ${CA} --logfile="$testdir/client.log" </dev/null >/dev/null ||
|
||||
+ fail ${PID} "expected connection to succeed (7)"
|
||||
+
|
||||
+# "tls-session-hash" has precedence over %NO_SESSION_HASH
|
||||
+"${CLI}" -p "${PORT}" 127.0.0.1 --priority "NORMAL:-VERS-ALL:+VERS-TLS1.2:%NO_SESSION_HASH" --verify-hostname=localhost --x509cafile ${CA} --logfile="$testdir/client.log" </dev/null >/dev/null ||
|
||||
+ fail ${PID} "expected connection to succeed (8)"
|
||||
+
|
||||
+kill ${PID}
|
||||
+wait
|
||||
+
|
||||
+rm -rf "$testdir"
|
||||
diff --git a/tests/tls-force-ems.c b/tests/tls-force-ems.c
|
||||
new file mode 100644
|
||||
index 0000000..35e7010
|
||||
--- /dev/null
|
||||
+++ b/tests/tls-force-ems.c
|
||||
@@ -0,0 +1,148 @@
|
||||
+/*
|
||||
+ * Copyright (C) 2023 Red Hat, Inc.
|
||||
+ *
|
||||
+ * Author: Daiki Ueno
|
||||
+ *
|
||||
+ * This file is part of GnuTLS.
|
||||
+ *
|
||||
+ * GnuTLS is free software; you can redistribute it and/or modify it
|
||||
+ * under the terms of the GNU General Public License as published by
|
||||
+ * the Free Software Foundation; either version 3 of the License, or
|
||||
+ * (at your option) any later version.
|
||||
+ *
|
||||
+ * GnuTLS is distributed in the hope that it will be useful, but
|
||||
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
+ * General Public License for more details.
|
||||
+ *
|
||||
+ * You should have received a copy of the GNU Lesser General Public License
|
||||
+ * along with this program. If not, see <https://www.gnu.org/licenses/>
|
||||
+ */
|
||||
+
|
||||
+#ifdef HAVE_CONFIG_H
|
||||
+# include <config.h>
|
||||
+#endif
|
||||
+
|
||||
+#include <stdio.h>
|
||||
+#include <stdlib.h>
|
||||
+
|
||||
+#include "utils.h"
|
||||
+#include "cert-common.h"
|
||||
+#include "eagain-common.h"
|
||||
+
|
||||
+/* This program tests whether forced extended master secret is
|
||||
+ * negotiated as expected.
|
||||
+ */
|
||||
+
|
||||
+const char *side;
|
||||
+
|
||||
+static void tls_log_func(int level, const char *str)
|
||||
+{
|
||||
+ fprintf(stderr, "%s|<%d>| %s", side, level, str);
|
||||
+}
|
||||
+
|
||||
+static void
|
||||
+try(const char *name, const char *sprio, const char *cprio, int serr, int cerr)
|
||||
+{
|
||||
+ int sret, cret;
|
||||
+ gnutls_certificate_credentials_t scred, ccred;
|
||||
+ gnutls_session_t server, client;
|
||||
+
|
||||
+ success("Running %s\n", name);
|
||||
+
|
||||
+ assert(gnutls_certificate_allocate_credentials(&scred) >= 0);
|
||||
+
|
||||
+ assert(gnutls_certificate_set_x509_key_mem
|
||||
+ (scred, &server_ca3_localhost_cert,
|
||||
+ &server_ca3_key, GNUTLS_X509_FMT_PEM) >= 0);
|
||||
+
|
||||
+ assert(gnutls_certificate_allocate_credentials(&ccred) >= 0);
|
||||
+
|
||||
+ assert(gnutls_certificate_set_x509_trust_mem
|
||||
+ (ccred, &ca3_cert, GNUTLS_X509_FMT_PEM) >= 0);
|
||||
+
|
||||
+ assert(gnutls_init(&server, GNUTLS_SERVER) >= 0);
|
||||
+ assert(gnutls_init(&client, GNUTLS_CLIENT) >= 0);
|
||||
+
|
||||
+ gnutls_credentials_set(server, GNUTLS_CRD_CERTIFICATE, scred);
|
||||
+ gnutls_credentials_set(client, GNUTLS_CRD_CERTIFICATE, ccred);
|
||||
+
|
||||
+ gnutls_transport_set_push_function(server, server_push);
|
||||
+ gnutls_transport_set_pull_function(server, server_pull);
|
||||
+ gnutls_transport_set_ptr(server, server);
|
||||
+ assert(gnutls_priority_set_direct(server, sprio, 0) >= 0);
|
||||
+
|
||||
+ gnutls_transport_set_push_function(client, client_push);
|
||||
+ gnutls_transport_set_pull_function(client, client_pull);
|
||||
+ gnutls_transport_set_ptr(client, client);
|
||||
+ assert(gnutls_priority_set_direct(client, cprio, 0) >= 0);
|
||||
+
|
||||
+ HANDSHAKE_EXPECT(client, server, cerr, serr);
|
||||
+
|
||||
+ gnutls_deinit(server);
|
||||
+ gnutls_deinit(client);
|
||||
+ gnutls_certificate_free_credentials(scred);
|
||||
+ gnutls_certificate_free_credentials(ccred);
|
||||
+
|
||||
+ reset_buffers();
|
||||
+}
|
||||
+
|
||||
+#define AES_GCM "NORMAL:-VERS-ALL:+VERS-TLS1.2"
|
||||
+
|
||||
+void doit(void)
|
||||
+{
|
||||
+ gnutls_fips140_context_t fips_context;
|
||||
+
|
||||
+ global_init();
|
||||
+
|
||||
+ /* General init. */
|
||||
+ gnutls_global_set_log_function(tls_log_func);
|
||||
+ if (debug)
|
||||
+ gnutls_global_set_log_level(2);
|
||||
+
|
||||
+ assert(gnutls_fips140_context_init(&fips_context) >= 0);
|
||||
+
|
||||
+ /* Default: EMS is requested in non-FIPS mode, while it is
|
||||
+ * required in FIPS mode.
|
||||
+ */
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ try("default", AES_GCM, AES_GCM, 0, 0);
|
||||
+ FIPS_POP_CONTEXT(APPROVED);
|
||||
+
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ try("both force EMS", AES_GCM ":%FORCE_SESSION_HASH",
|
||||
+ AES_GCM ":%FORCE_SESSION_HASH", 0, 0);
|
||||
+ FIPS_POP_CONTEXT(APPROVED);
|
||||
+
|
||||
+ if (gnutls_fips140_mode_enabled()) {
|
||||
+ try("neither negotiates EMS", AES_GCM ":%NO_SESSION_HASH",
|
||||
+ AES_GCM ":%NO_SESSION_HASH", GNUTLS_E_INSUFFICIENT_SECURITY,
|
||||
+ GNUTLS_E_AGAIN);
|
||||
+ } else {
|
||||
+ try("neither negotiates EMS", AES_GCM ":%NO_SESSION_HASH",
|
||||
+ AES_GCM ":%NO_SESSION_HASH", 0, 0);
|
||||
+ }
|
||||
+ /* Note that the error codes are swapped based on FIPS mode:
|
||||
+ * in FIPS mode, the server doesn't send the extension which
|
||||
+ * causes the client to not send the one either, and then the
|
||||
+ * server doesn't like the situation. On the other hand, in
|
||||
+ * non-FIPS mode, it's the client to decide to abort the
|
||||
+ * connection.
|
||||
+ */
|
||||
+ if (gnutls_fips140_mode_enabled()) {
|
||||
+ try("server doesn't negotiate EMS, client forces EMS",
|
||||
+ AES_GCM ":%NO_SESSION_HASH", AES_GCM ":%FORCE_SESSION_HASH",
|
||||
+ GNUTLS_E_INSUFFICIENT_SECURITY, GNUTLS_E_AGAIN);
|
||||
+ } else {
|
||||
+ try("server doesn't negotiate EMS, client forces EMS",
|
||||
+ AES_GCM ":%NO_SESSION_HASH", AES_GCM ":%FORCE_SESSION_HASH",
|
||||
+ GNUTLS_E_AGAIN, GNUTLS_E_INSUFFICIENT_SECURITY);
|
||||
+ }
|
||||
+ try("server forces EMS, client doesn't negotiate EMS",
|
||||
+ AES_GCM ":%FORCE_SESSION_HASH", AES_GCM ":%NO_SESSION_HASH",
|
||||
+ GNUTLS_E_INSUFFICIENT_SECURITY, GNUTLS_E_AGAIN);
|
||||
+
|
||||
+ gnutls_fips140_context_deinit(fips_context);
|
||||
+
|
||||
+ gnutls_global_deinit();
|
||||
+}
|
||||
--
|
||||
2.41.0
|
||||
|
|
@ -1,58 +0,0 @@
|
|||
From de09280b2a8314eb98ec9a2b84eebe3eec2f49bd Mon Sep 17 00:00:00 2001
|
||||
From: Daiki Ueno <ueno@gnu.org>
|
||||
Date: Thu, 4 Aug 2022 16:37:51 +0900
|
||||
Subject: [PATCH] _gnutls_decrypt_pbes1_des_md5_data: use public crypto API
|
||||
|
||||
This is a follow-up of e7f9267342bc2231149a640163c82b63c86f1dfd. In
|
||||
the decryption code path with PBES1, algorithm checks for FIPS was not
|
||||
applied, because it used internal functions that bypass those checks.
|
||||
|
||||
Signed-off-by: Daiki Ueno <ueno@gnu.org>
|
||||
---
|
||||
lib/x509/privkey_pkcs8_pbes1.c | 10 ++++------
|
||||
1 file changed, 4 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/lib/x509/privkey_pkcs8_pbes1.c b/lib/x509/privkey_pkcs8_pbes1.c
|
||||
index c296807974..983530e46a 100644
|
||||
--- a/lib/x509/privkey_pkcs8_pbes1.c
|
||||
+++ b/lib/x509/privkey_pkcs8_pbes1.c
|
||||
@@ -140,7 +140,7 @@ _gnutls_decrypt_pbes1_des_md5_data(const char *password,
|
||||
{
|
||||
int result;
|
||||
gnutls_datum_t dkey, d_iv;
|
||||
- cipher_hd_st ch;
|
||||
+ gnutls_cipher_hd_t ch;
|
||||
uint8_t key[16];
|
||||
const unsigned block_size = 8;
|
||||
|
||||
@@ -158,16 +158,14 @@ _gnutls_decrypt_pbes1_des_md5_data(const char *password,
|
||||
dkey.size = 8;
|
||||
d_iv.data = &key[8];
|
||||
d_iv.size = 8;
|
||||
- result =
|
||||
- _gnutls_cipher_init(&ch, cipher_to_entry(GNUTLS_CIPHER_DES_CBC),
|
||||
- &dkey, &d_iv, 0);
|
||||
+ result = gnutls_cipher_init(&ch, GNUTLS_CIPHER_DES_CBC, &dkey, &d_iv);
|
||||
if (result < 0) {
|
||||
_gnutls_switch_fips_state(GNUTLS_FIPS140_OP_ERROR);
|
||||
return gnutls_assert_val(result);
|
||||
}
|
||||
_gnutls_switch_fips_state(GNUTLS_FIPS140_OP_NOT_APPROVED);
|
||||
|
||||
- result = _gnutls_cipher_decrypt(&ch, encrypted_data->data, encrypted_data->size);
|
||||
+ result = gnutls_cipher_decrypt(ch, encrypted_data->data, encrypted_data->size);
|
||||
if (result < 0) {
|
||||
gnutls_assert();
|
||||
goto error;
|
||||
@@ -184,7 +182,7 @@ _gnutls_decrypt_pbes1_des_md5_data(const char *password,
|
||||
|
||||
result = 0;
|
||||
error:
|
||||
- _gnutls_cipher_deinit(&ch);
|
||||
+ gnutls_cipher_deinit(ch);
|
||||
|
||||
return result;
|
||||
}
|
||||
--
|
||||
2.37.1
|
||||
|
|
@ -1,476 +0,0 @@
|
|||
From 237695d30c9f716333cfa077554a6e1ae0d2c589 Mon Sep 17 00:00:00 2001
|
||||
From: rpm-build <rpm-build>
|
||||
Date: Sat, 20 Aug 2022 09:52:08 +0900
|
||||
Subject: [PATCH] gnutls-3.7.6-fips-rsa-key-sizes.patch
|
||||
|
||||
---
|
||||
lib/nettle/pk.c | 54 ++++---
|
||||
tests/Makefile.am | 3 +-
|
||||
tests/fips-rsa-sizes.c | 328 +++++++++++++++++++++++++++++++++++++++++
|
||||
3 files changed, 361 insertions(+), 24 deletions(-)
|
||||
create mode 100644 tests/fips-rsa-sizes.c
|
||||
|
||||
diff --git a/lib/nettle/pk.c b/lib/nettle/pk.c
|
||||
index eba246f..f38016b 100644
|
||||
--- a/lib/nettle/pk.c
|
||||
+++ b/lib/nettle/pk.c
|
||||
@@ -1247,20 +1247,20 @@ _wrap_nettle_pk_sign(gnutls_pk_algorithm_t algo,
|
||||
|
||||
_rsa_params_to_privkey(pk_params, &priv);
|
||||
|
||||
- /* RSA key size should be 2048-bit or larger in FIPS
|
||||
- * 140-3. In addition to this, only SHA-2 is allowed
|
||||
- * for SigGen; it is checked in pk_prepare_hash lib/pk.c
|
||||
- */
|
||||
- if (unlikely(priv.size < 256)) {
|
||||
- not_approved = true;
|
||||
- }
|
||||
-
|
||||
ret = _rsa_params_to_pubkey(pk_params, &pub);
|
||||
if (ret < 0) {
|
||||
gnutls_assert();
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
+ /* RSA modulus size should be 2048-bit or larger in FIPS
|
||||
+ * 140-3. In addition to this, only SHA-2 is allowed
|
||||
+ * for SigGen; it is checked in pk_prepare_hash lib/pk.c
|
||||
+ */
|
||||
+ if (unlikely(mpz_sizeinbase(pub.n, 2) < 2048)) {
|
||||
+ not_approved = true;
|
||||
+ }
|
||||
+
|
||||
mpz_init(s);
|
||||
|
||||
if (_gnutls_get_lib_state() == LIB_STATE_SELFTEST)
|
||||
@@ -1298,22 +1298,22 @@ _wrap_nettle_pk_sign(gnutls_pk_algorithm_t algo,
|
||||
|
||||
_rsa_params_to_privkey(pk_params, &priv);
|
||||
|
||||
- /* RSA key size should be 2048-bit or larger in FIPS
|
||||
+ ret = _rsa_params_to_pubkey(pk_params, &pub);
|
||||
+ if (ret < 0) {
|
||||
+ gnutls_assert();
|
||||
+ goto cleanup;
|
||||
+ }
|
||||
+
|
||||
+ /* RSA modulus size should be 2048-bit or larger in FIPS
|
||||
* 140-3. In addition to this, only SHA-2 is allowed
|
||||
* for SigGen; however, Nettle only support SHA256,
|
||||
* SHA384, and SHA512 for RSA-PSS (see
|
||||
* _rsa_pss_sign_digest_tr in this file for details).
|
||||
*/
|
||||
- if (unlikely(priv.size < 256)) {
|
||||
+ if (unlikely(mpz_sizeinbase(pub.n, 2) < 2048)) {
|
||||
not_approved = true;
|
||||
}
|
||||
|
||||
- ret = _rsa_params_to_pubkey(pk_params, &pub);
|
||||
- if (ret < 0) {
|
||||
- gnutls_assert();
|
||||
- goto cleanup;
|
||||
- }
|
||||
-
|
||||
mpz_init(s);
|
||||
|
||||
ret =
|
||||
@@ -1643,6 +1643,7 @@ _wrap_nettle_pk_verify(gnutls_pk_algorithm_t algo,
|
||||
case GNUTLS_PK_RSA:
|
||||
{
|
||||
struct rsa_public_key pub;
|
||||
+ size_t bits;
|
||||
|
||||
ret = _rsa_params_to_pubkey(pk_params, &pub);
|
||||
if (ret < 0) {
|
||||
@@ -1650,12 +1651,19 @@ _wrap_nettle_pk_verify(gnutls_pk_algorithm_t algo,
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
- /* RSA key size should be 2048-bit or larger in FIPS
|
||||
- * 140-3. In addition to this, only SHA-1 and SHA-2 are
|
||||
- * allowed for SigVer; it is checked in
|
||||
- * _pkcs1_rsa_verify_sig in lib/pubkey.c
|
||||
+ bits = mpz_sizeinbase(pub.n, 2);
|
||||
+
|
||||
+ /* In FIPS 140-3, RSA key size should be larger than
|
||||
+ * 2048-bit or one of the known lengths (1024, 1280,
|
||||
+ * 1536, 1792; i.e., multiple of 256-bits).
|
||||
+ *
|
||||
+ * In addition to this, only SHA-1 and SHA-2 are allowed
|
||||
+ * for SigVer; it is checked in _pkcs1_rsa_verify_sig in
|
||||
+ * lib/pubkey.c.
|
||||
*/
|
||||
- if (unlikely(pub.size < 256)) {
|
||||
+ if (unlikely(bits < 2048 &&
|
||||
+ bits != 1024 && bits != 1280 &&
|
||||
+ bits != 1536 && bits != 1792)) {
|
||||
not_approved = true;
|
||||
}
|
||||
|
||||
@@ -1701,13 +1709,13 @@ _wrap_nettle_pk_verify(gnutls_pk_algorithm_t algo,
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
- /* RSA key size should be 2048-bit or larger in FIPS
|
||||
+ /* RSA modulus size should be 2048-bit or larger in FIPS
|
||||
* 140-3. In addition to this, only SHA-1 and SHA-2 are
|
||||
* allowed for SigVer, while Nettle only supports
|
||||
* SHA256, SHA384, and SHA512 for RSA-PSS (see
|
||||
* _rsa_pss_verify_digest in this file for the details).
|
||||
*/
|
||||
- if (unlikely(pub.size < 256)) {
|
||||
+ if (unlikely(mpz_sizeinbase(pub.n, 2) < 2048)) {
|
||||
not_approved = true;
|
||||
}
|
||||
|
||||
diff --git a/tests/Makefile.am b/tests/Makefile.am
|
||||
index 7a7a4af..dd21e45 100644
|
||||
--- a/tests/Makefile.am
|
||||
+++ b/tests/Makefile.am
|
||||
@@ -233,7 +233,8 @@ ctests += mini-record-2 simple gnutls_hmac_fast set_pkcs12_cred cert certuniquei
|
||||
tls13-without-timeout-func buffer status-request-revoked \
|
||||
set_x509_ocsp_multi_cli kdf-api keylog-func handshake-write \
|
||||
x509cert-dntypes id-on-xmppAddr tls13-compat-mode ciphersuite-name \
|
||||
- x509-upnconstraint pkcs7-verify-double-free
|
||||
+ x509-upnconstraint pkcs7-verify-double-free \
|
||||
+ fips-rsa-sizes
|
||||
|
||||
ctests += tls-channel-binding
|
||||
|
||||
diff --git a/tests/fips-rsa-sizes.c b/tests/fips-rsa-sizes.c
|
||||
new file mode 100644
|
||||
index 0000000..84b9aff
|
||||
--- /dev/null
|
||||
+++ b/tests/fips-rsa-sizes.c
|
||||
@@ -0,0 +1,328 @@
|
||||
+/*
|
||||
+ * Copyright (C) 2022 Red Hat, Inc.
|
||||
+ *
|
||||
+ * Author: Alexander Sosedkin
|
||||
+ *
|
||||
+ * This file is part of GnuTLS.
|
||||
+ *
|
||||
+ * GnuTLS is free software; you can redistribute it and/or modify it
|
||||
+ * under the terms of the GNU General Public License as published by
|
||||
+ * the Free Software Foundation; either version 3 of the License, or
|
||||
+ * (at your option) any later version.
|
||||
+ *
|
||||
+ * GnuTLS is distributed in the hope that it will be useful, but
|
||||
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
+ * General Public License for more details.
|
||||
+ *
|
||||
+ * You should have received a copy of the GNU General Public License
|
||||
+ * along with GnuTLS; if not, write to the Free Software Foundation,
|
||||
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
|
||||
+ */
|
||||
+
|
||||
+#include <assert.h>
|
||||
+#include <stdio.h>
|
||||
+#include <utils.h>
|
||||
+#include <gnutls/gnutls.h>
|
||||
+#include <gnutls/abstract.h>
|
||||
+#include <gnutls/x509.h>
|
||||
+
|
||||
+#define FIPS_PUSH_CONTEXT() do { \
|
||||
+ ret = gnutls_fips140_push_context(fips_context); \
|
||||
+ if (ret < 0) { \
|
||||
+ fail("gnutls_fips140_push_context failed\n"); \
|
||||
+ } \
|
||||
+} while (0)
|
||||
+
|
||||
+#define FIPS_POP_CONTEXT(state) do { \
|
||||
+ ret = gnutls_fips140_pop_context(); \
|
||||
+ if (ret < 0) { \
|
||||
+ fail("gnutls_fips140_context_pop failed\n"); \
|
||||
+ } \
|
||||
+ fips_state = gnutls_fips140_get_operation_state(fips_context); \
|
||||
+ if (fips_state != GNUTLS_FIPS140_OP_ ## state) { \
|
||||
+ fail("operation state is not " # state " (%d)\n", \
|
||||
+ fips_state); \
|
||||
+ } \
|
||||
+} while (0)
|
||||
+
|
||||
+
|
||||
+void generate_successfully(gnutls_privkey_t* privkey, gnutls_pubkey_t* pubkey,
|
||||
+ unsigned int size);
|
||||
+void generate_unsuccessfully(gnutls_privkey_t* privkey, gnutls_pubkey_t* pubkey,
|
||||
+ unsigned int size);
|
||||
+void sign_verify_successfully(gnutls_privkey_t privkey, gnutls_pubkey_t pubkey);
|
||||
+void sign_verify_unsuccessfully(gnutls_privkey_t privkey,
|
||||
+ gnutls_pubkey_t pubkey);
|
||||
+void nosign_verify(gnutls_privkey_t privkey, gnutls_pubkey_t pubkey);
|
||||
+
|
||||
+
|
||||
+void generate_successfully(gnutls_privkey_t* privkey, gnutls_pubkey_t* pubkey,
|
||||
+ unsigned int size)
|
||||
+{
|
||||
+ int ret;
|
||||
+ gnutls_x509_privkey_t xprivkey;
|
||||
+ gnutls_fips140_context_t fips_context;
|
||||
+ gnutls_fips140_operation_state_t fips_state;
|
||||
+ assert(gnutls_fips140_context_init(&fips_context) == 0);
|
||||
+
|
||||
+ fprintf(stderr, "%d-bit\n", size);
|
||||
+
|
||||
+ /* x509 generation as well just because why not */
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ assert(gnutls_x509_privkey_init(&xprivkey) == 0);
|
||||
+ ret = gnutls_x509_privkey_generate(xprivkey, GNUTLS_PK_RSA, size, 0);
|
||||
+ if (ret != GNUTLS_E_SUCCESS)
|
||||
+ fail("%d-bit x509_privkey_init (%d)\n", size, ret);
|
||||
+ FIPS_POP_CONTEXT(APPROVED);
|
||||
+ gnutls_x509_privkey_deinit(xprivkey);
|
||||
+
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ assert(gnutls_privkey_init(privkey) == 0);
|
||||
+ ret = gnutls_privkey_generate(*privkey, GNUTLS_PK_RSA, size, 0);
|
||||
+ if (ret != GNUTLS_E_SUCCESS)
|
||||
+ fail("%d-bit privkey_init (%d)\n", size, ret);
|
||||
+ FIPS_POP_CONTEXT(APPROVED);
|
||||
+
|
||||
+ assert(gnutls_pubkey_init(pubkey) == 0);
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ ret = gnutls_pubkey_import_privkey(*pubkey, *privkey,
|
||||
+ GNUTLS_KEY_DIGITAL_SIGNATURE, 0);
|
||||
+ if (ret != GNUTLS_E_SUCCESS)
|
||||
+ fail("%d-bit pubkey_import_privkey (%d)\n", size, ret);
|
||||
+ FIPS_POP_CONTEXT(INITIAL);
|
||||
+
|
||||
+ gnutls_fips140_context_deinit(fips_context);
|
||||
+}
|
||||
+
|
||||
+
|
||||
+void generate_unsuccessfully(gnutls_privkey_t* privkey, gnutls_pubkey_t* pubkey,
|
||||
+ unsigned int size)
|
||||
+{
|
||||
+ int ret;
|
||||
+ gnutls_x509_privkey_t xprivkey;
|
||||
+ gnutls_fips140_context_t fips_context;
|
||||
+ gnutls_fips140_operation_state_t fips_state;
|
||||
+ assert(gnutls_fips140_context_init(&fips_context) == 0);
|
||||
+
|
||||
+ fprintf(stderr, "%d-bit\n", size);
|
||||
+
|
||||
+ /* short x509 generation: ERROR, blocked */
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ assert(gnutls_x509_privkey_init(&xprivkey) == 0);
|
||||
+ ret = gnutls_x509_privkey_generate(xprivkey, GNUTLS_PK_RSA, size, 0);
|
||||
+ if (ret != GNUTLS_E_PK_GENERATION_ERROR)
|
||||
+ fail("%d-bit x509_privkey_init (%d)\n", size, ret);
|
||||
+ FIPS_POP_CONTEXT(ERROR);
|
||||
+ gnutls_x509_privkey_deinit(xprivkey);
|
||||
+
|
||||
+ /* short key generation: ERROR, blocked */
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ assert(gnutls_privkey_init(privkey) == 0);
|
||||
+ ret = gnutls_privkey_generate(*privkey, GNUTLS_PK_RSA, size, 0);
|
||||
+ if (ret != GNUTLS_E_PK_GENERATION_ERROR)
|
||||
+ fail("%d-bit privkey_init (%d)\n", size, ret);
|
||||
+ FIPS_POP_CONTEXT(ERROR);
|
||||
+ gnutls_privkey_deinit(*privkey);
|
||||
+
|
||||
+ /* Disable FIPS to generate them anyway */
|
||||
+ gnutls_fips140_set_mode(GNUTLS_FIPS140_LAX, 0);
|
||||
+ assert(gnutls_fips140_mode_enabled() == GNUTLS_FIPS140_LAX);
|
||||
+
|
||||
+ assert(gnutls_x509_privkey_init(&xprivkey) == 0);
|
||||
+ ret = gnutls_x509_privkey_generate(xprivkey, GNUTLS_PK_RSA, size, 0);
|
||||
+ if (ret != GNUTLS_E_SUCCESS)
|
||||
+ fail("%d-bit x509_privkey_init (%d)\n", size, ret);
|
||||
+ gnutls_x509_privkey_deinit(xprivkey);
|
||||
+
|
||||
+ assert(gnutls_privkey_init(privkey) == 0);
|
||||
+ ret = gnutls_privkey_generate(*privkey, GNUTLS_PK_RSA, size, 0);
|
||||
+ if (ret != GNUTLS_E_SUCCESS)
|
||||
+ fail("%d-bit privkey_init (%d)\n", size, ret);
|
||||
+
|
||||
+ assert(gnutls_pubkey_init(pubkey) == 0);
|
||||
+ ret = gnutls_pubkey_import_privkey(*pubkey, *privkey,
|
||||
+ GNUTLS_KEY_DIGITAL_SIGNATURE, 0);
|
||||
+ if (ret != GNUTLS_E_SUCCESS)
|
||||
+ fail("%d-bit pubkey_import_privkey (%d)\n", size, ret);
|
||||
+
|
||||
+ gnutls_fips140_set_mode(GNUTLS_FIPS140_STRICT, 0);
|
||||
+ assert(gnutls_fips140_mode_enabled());
|
||||
+
|
||||
+ gnutls_fips140_context_deinit(fips_context);
|
||||
+}
|
||||
+
|
||||
+
|
||||
+void sign_verify_successfully(gnutls_privkey_t privkey, gnutls_pubkey_t pubkey) {
|
||||
+ int ret;
|
||||
+ gnutls_fips140_context_t fips_context;
|
||||
+ gnutls_fips140_operation_state_t fips_state;
|
||||
+
|
||||
+ gnutls_datum_t signature;
|
||||
+ gnutls_datum_t plaintext = {
|
||||
+ .data = (unsigned char* const) "Hello world!",
|
||||
+ .size = 12
|
||||
+ };
|
||||
+ assert(gnutls_fips140_context_init(&fips_context) == 0);
|
||||
+
|
||||
+ /* RSA sign: approved */
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ ret = gnutls_privkey_sign_data(privkey, GNUTLS_DIG_SHA256, 0,
|
||||
+ &plaintext, &signature);
|
||||
+ if (ret < 0)
|
||||
+ fail("gnutls_privkey_sign_data failed\n");
|
||||
+ FIPS_POP_CONTEXT(APPROVED);
|
||||
+
|
||||
+ /* RSA verify: approved */
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ ret = gnutls_pubkey_verify_data2(pubkey, GNUTLS_SIGN_RSA_SHA256, 0,
|
||||
+ &plaintext, &signature);
|
||||
+ if (ret < 0)
|
||||
+ fail("gnutls_pubkey_verify_data2 failed\n");
|
||||
+ FIPS_POP_CONTEXT(APPROVED);
|
||||
+
|
||||
+ gnutls_free(signature.data);
|
||||
+ gnutls_fips140_context_deinit(fips_context);
|
||||
+}
|
||||
+
|
||||
+
|
||||
+void sign_verify_unsuccessfully(gnutls_privkey_t privkey,
|
||||
+ gnutls_pubkey_t pubkey) {
|
||||
+ int ret;
|
||||
+ gnutls_fips140_context_t fips_context;
|
||||
+ gnutls_fips140_operation_state_t fips_state;
|
||||
+
|
||||
+ gnutls_datum_t signature;
|
||||
+ gnutls_datum_t plaintext = {
|
||||
+ .data = (unsigned char* const) "Hello world!",
|
||||
+ .size = 12
|
||||
+ };
|
||||
+ assert(gnutls_fips140_context_init(&fips_context) == 0);
|
||||
+
|
||||
+ /* small key RSA sign: not approved */
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ ret = gnutls_privkey_sign_data(privkey, GNUTLS_DIG_SHA256, 0,
|
||||
+ &plaintext, &signature);
|
||||
+ if (ret < 0)
|
||||
+ fail("gnutls_privkey_sign_data failed\n");
|
||||
+ FIPS_POP_CONTEXT(NOT_APPROVED);
|
||||
+
|
||||
+ /* small key RSA verify: not approved */
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ ret = gnutls_pubkey_verify_data2(pubkey, GNUTLS_SIGN_RSA_SHA256, 0,
|
||||
+ &plaintext, &signature);
|
||||
+ if (ret < 0)
|
||||
+ fail("gnutls_pubkey_verify_data2 failed\n");
|
||||
+ FIPS_POP_CONTEXT(NOT_APPROVED);
|
||||
+
|
||||
+ gnutls_free(signature.data);
|
||||
+ gnutls_pubkey_deinit(pubkey);
|
||||
+ gnutls_privkey_deinit(privkey);
|
||||
+ gnutls_fips140_context_deinit(fips_context);
|
||||
+}
|
||||
+
|
||||
+
|
||||
+void nosign_verify(gnutls_privkey_t privkey, gnutls_pubkey_t pubkey) {
|
||||
+ int ret;
|
||||
+ gnutls_fips140_context_t fips_context;
|
||||
+ gnutls_fips140_operation_state_t fips_state;
|
||||
+
|
||||
+ gnutls_datum_t signature;
|
||||
+ gnutls_datum_t plaintext = {
|
||||
+ .data = (unsigned char* const) "Hello world!",
|
||||
+ .size = 12
|
||||
+ };
|
||||
+ assert(gnutls_fips140_context_init(&fips_context) == 0);
|
||||
+
|
||||
+ /* 1024, 1280, 1536, 1792 key RSA sign: not approved */
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ ret = gnutls_privkey_sign_data(privkey, GNUTLS_DIG_SHA256, 0,
|
||||
+ &plaintext, &signature);
|
||||
+ if (ret < 0)
|
||||
+ fail("gnutls_privkey_sign_data failed\n");
|
||||
+ FIPS_POP_CONTEXT(NOT_APPROVED);
|
||||
+
|
||||
+ /* Disable FIPS to sign them anyway */
|
||||
+ gnutls_fips140_set_mode(GNUTLS_FIPS140_LAX, 0);
|
||||
+ assert(gnutls_fips140_mode_enabled() == GNUTLS_FIPS140_LAX);
|
||||
+
|
||||
+ ret = gnutls_privkey_sign_data(privkey, GNUTLS_DIG_SHA256, 0,
|
||||
+ &plaintext, &signature);
|
||||
+ if (ret < 0)
|
||||
+ fail("gnutls_privkey_sign_data failed\n");
|
||||
+
|
||||
+ gnutls_fips140_set_mode(GNUTLS_FIPS140_STRICT, 0);
|
||||
+ assert(gnutls_fips140_mode_enabled());
|
||||
+
|
||||
+ /* 1024, 1280, 1536, 1792 key RSA verify: approved (exception) */
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ ret = gnutls_pubkey_verify_data2(pubkey, GNUTLS_SIGN_RSA_SHA256, 0,
|
||||
+ &plaintext, &signature);
|
||||
+ if (ret < 0)
|
||||
+ fail("gnutls_pubkey_verify_data2 failed\n");
|
||||
+ FIPS_POP_CONTEXT(APPROVED);
|
||||
+
|
||||
+ gnutls_free(signature.data);
|
||||
+ gnutls_pubkey_deinit(pubkey);
|
||||
+ gnutls_privkey_deinit(privkey);
|
||||
+ gnutls_fips140_context_deinit(fips_context);
|
||||
+}
|
||||
+
|
||||
+
|
||||
+void doit(void)
|
||||
+{
|
||||
+ gnutls_fips140_context_t fips_context;
|
||||
+ gnutls_privkey_t privkey;
|
||||
+ gnutls_pubkey_t pubkey;
|
||||
+
|
||||
+ if (gnutls_fips140_mode_enabled() == 0) {
|
||||
+ success("We are not in FIPS140 mode\n");
|
||||
+ exit(77); /* SKIP */
|
||||
+ }
|
||||
+
|
||||
+ assert(gnutls_fips140_context_init(&fips_context) == 0);
|
||||
+
|
||||
+ /* 512-bit RSA: no generate, no sign, no verify */
|
||||
+ generate_unsuccessfully(&privkey, &pubkey, 512);
|
||||
+ sign_verify_unsuccessfully(privkey, pubkey);
|
||||
+ /* 512-bit RSA again (to be safer about going in and out of FIPS) */
|
||||
+ generate_unsuccessfully(&privkey, &pubkey, 512);
|
||||
+ sign_verify_unsuccessfully(privkey, pubkey);
|
||||
+ /* 600-bit RSA: no generate, no sign, no verify */
|
||||
+ generate_unsuccessfully(&privkey, &pubkey, 600);
|
||||
+ sign_verify_unsuccessfully(privkey, pubkey);
|
||||
+
|
||||
+ /* 768-bit RSA not-an-exception: nogenerate, nosign, verify */
|
||||
+ generate_unsuccessfully(&privkey, &pubkey, 768);
|
||||
+ sign_verify_unsuccessfully(privkey, pubkey);
|
||||
+ /* 1024-bit RSA exception: nogenerate, nosign, verify */
|
||||
+ generate_unsuccessfully(&privkey, &pubkey, 1024);
|
||||
+ nosign_verify(privkey, pubkey);
|
||||
+ /* 1280-bit RSA exception: nogenerate, nosign, verify */
|
||||
+ generate_unsuccessfully(&privkey, &pubkey, 1280);
|
||||
+ nosign_verify(privkey, pubkey);
|
||||
+ /* 1500-bit RSA not-an-exception: nogenerate, nosign, noverify */
|
||||
+ generate_unsuccessfully(&privkey, &pubkey, 1500);
|
||||
+ sign_verify_unsuccessfully(privkey, pubkey);
|
||||
+ /* 1536-bit RSA exception: nogenerate, nosign, verify */
|
||||
+ generate_unsuccessfully(&privkey, &pubkey, 1536);
|
||||
+ nosign_verify(privkey, pubkey);
|
||||
+ /* 1792-bit RSA exception: nogenerate, nosign, verify */
|
||||
+ generate_unsuccessfully(&privkey, &pubkey, 1792);
|
||||
+ nosign_verify(privkey, pubkey);
|
||||
+ /* 2000-bit RSA not-an-exception: nogenerate, nosign, noverify */
|
||||
+ generate_unsuccessfully(&privkey, &pubkey, 2000);
|
||||
+ sign_verify_unsuccessfully(privkey, pubkey);
|
||||
+
|
||||
+ /* 2048-bit RSA: generate, sign, verify */
|
||||
+ generate_successfully(&privkey, &pubkey, 2048);
|
||||
+ sign_verify_successfully(privkey, pubkey);
|
||||
+ /* 2432-bit RSA: nogenerate, sign, verify */
|
||||
+ generate_unsuccessfully(&privkey, &pubkey, 2432);
|
||||
+ sign_verify_successfully(privkey, pubkey);
|
||||
+ /* 3072-bit RSA: generate, sign, verify */
|
||||
+ generate_successfully(&privkey, &pubkey, 3072);
|
||||
+ sign_verify_successfully(privkey, pubkey);
|
||||
+
|
||||
+ gnutls_fips140_context_deinit(fips_context);
|
||||
+}
|
||||
--
|
||||
2.37.2
|
||||
|
|
@ -1,163 +0,0 @@
|
|||
From 3bd42dc88ff062bf9ede2b593e1ad1afa6f68f62 Mon Sep 17 00:00:00 2001
|
||||
From: Daiki Ueno <ueno@gnu.org>
|
||||
Date: Wed, 16 Nov 2022 23:02:13 +0900
|
||||
Subject: [PATCH] nettle: mark non-compliant RSA-PSS salt length to be
|
||||
not-approved
|
||||
|
||||
According to FIPS 186-5 5.4, the salt length must be in the range
|
||||
between 0 and the hash length inclusive. While the use of those salt
|
||||
lengths is still allowed for compatibility, it is reported as
|
||||
non-approved operation through FIPS service indicator.
|
||||
|
||||
Signed-off-by: Daiki Ueno <ueno@gnu.org>
|
||||
---
|
||||
lib/nettle/pk.c | 9 ++++++++
|
||||
tests/rsa-rsa-pss.c | 54 ++++++++++++++++++++++++++++++++++++---------
|
||||
2 files changed, 53 insertions(+), 10 deletions(-)
|
||||
|
||||
diff --git a/lib/nettle/pk.c b/lib/nettle/pk.c
|
||||
index c098e2aa45..7732e90542 100644
|
||||
--- a/lib/nettle/pk.c
|
||||
+++ b/lib/nettle/pk.c
|
||||
@@ -1316,6 +1316,15 @@ _wrap_nettle_pk_sign(gnutls_pk_algorithm_t algo,
|
||||
|
||||
mpz_init(s);
|
||||
|
||||
+ me = hash_to_entry(sign_params->rsa_pss_dig);
|
||||
+
|
||||
+ /* According to FIPS 186-5 5.4, the salt length must be
|
||||
+ * in the range between 0 and the hash length inclusive.
|
||||
+ */
|
||||
+ if (sign_params->salt_size > _gnutls_mac_get_algo_len(me)) {
|
||||
+ not_approved = true;
|
||||
+ }
|
||||
+
|
||||
ret =
|
||||
_rsa_pss_sign_digest_tr(sign_params->rsa_pss_dig,
|
||||
&pub, &priv,
|
||||
diff --git a/tests/rsa-rsa-pss.c b/tests/rsa-rsa-pss.c
|
||||
index 19a175b722..d7799c1961 100644
|
||||
--- a/tests/rsa-rsa-pss.c
|
||||
+++ b/tests/rsa-rsa-pss.c
|
||||
@@ -46,6 +46,8 @@ const gnutls_datum_t raw_data = {
|
||||
11
|
||||
};
|
||||
|
||||
+static gnutls_fips140_context_t fips_context;
|
||||
+
|
||||
static void inv_sign_check(unsigned sigalgo,
|
||||
gnutls_privkey_t privkey, int exp_error)
|
||||
{
|
||||
@@ -86,13 +88,16 @@ static void inv_encryption_check(gnutls_pk_algorithm_t algorithm,
|
||||
|
||||
static void sign_verify_data(unsigned sigalgo, gnutls_privkey_t privkey,
|
||||
unsigned int sign_flags, unsigned int verify_flags,
|
||||
- int sign_exp_error, int verify_exp_error)
|
||||
+ int sign_exp_error, int verify_exp_error,
|
||||
+ gnutls_fips140_operation_state_t sign_exp_state)
|
||||
{
|
||||
int ret;
|
||||
gnutls_datum_t signature = { NULL, 0 };
|
||||
|
||||
+ fips_push_context(fips_context);
|
||||
ret = gnutls_privkey_sign_data2(privkey, sigalgo, sign_flags,
|
||||
&raw_data, &signature);
|
||||
+ fips_pop_context(fips_context, sign_exp_state);
|
||||
if (ret != sign_exp_error)
|
||||
fail("gnutls_x509_privkey_sign_data returned unexpected error: %s\n",
|
||||
gnutls_strerror(ret));
|
||||
@@ -180,11 +185,16 @@ void doit(void)
|
||||
if (debug)
|
||||
gnutls_global_set_log_level(4711);
|
||||
|
||||
+ assert(gnutls_fips140_context_init(&fips_context) >= 0);
|
||||
+
|
||||
prepare_keys(&pkey_rsa_pss, &pkey_rsa, GNUTLS_DIG_SHA256, 32);
|
||||
|
||||
- sign_verify_data(GNUTLS_SIGN_RSA_PSS_SHA256, pkey_rsa_pss, 0, 0, 0, 0);
|
||||
- sign_verify_data(GNUTLS_SIGN_RSA_PSS_RSAE_SHA256, pkey_rsa, 0, 0, 0, 0);
|
||||
- sign_verify_data(GNUTLS_SIGN_RSA_PSS_SHA256, pkey_rsa, 0, 0, 0, 0);
|
||||
+ sign_verify_data(GNUTLS_SIGN_RSA_PSS_SHA256, pkey_rsa_pss, 0, 0, 0, 0,
|
||||
+ GNUTLS_FIPS140_OP_APPROVED);
|
||||
+ sign_verify_data(GNUTLS_SIGN_RSA_PSS_RSAE_SHA256, pkey_rsa, 0, 0, 0, 0,
|
||||
+ GNUTLS_FIPS140_OP_APPROVED);
|
||||
+ sign_verify_data(GNUTLS_SIGN_RSA_PSS_SHA256, pkey_rsa, 0, 0, 0, 0,
|
||||
+ GNUTLS_FIPS140_OP_APPROVED);
|
||||
|
||||
if (debug)
|
||||
success("success signing with RSA-PSS-SHA256\n");
|
||||
@@ -213,41 +223,65 @@ void doit(void)
|
||||
gnutls_privkey_deinit(pkey_rsa_pss);
|
||||
gnutls_privkey_deinit(pkey_rsa);
|
||||
|
||||
+ /* Restrict key to use salt length larger than hash output
|
||||
+ * length (not approved in FIPS).
|
||||
+ */
|
||||
+ prepare_keys(&pkey_rsa_pss, &pkey_rsa, GNUTLS_DIG_SHA256, 33);
|
||||
+
|
||||
+ sign_verify_data(GNUTLS_SIGN_RSA_PSS_SHA256, pkey_rsa_pss, 0, 0, 0, 0,
|
||||
+ GNUTLS_FIPS140_OP_NOT_APPROVED);
|
||||
+
|
||||
+ gnutls_privkey_deinit(pkey_rsa_pss);
|
||||
+ gnutls_privkey_deinit(pkey_rsa);
|
||||
+
|
||||
/* Use the mismatched salt length with the digest length */
|
||||
prepare_keys(&pkey_rsa_pss, &pkey_rsa, GNUTLS_DIG_SHA256, 48);
|
||||
|
||||
sign_verify_data(GNUTLS_SIGN_RSA_PSS_RSAE_SHA256, pkey_rsa_pss,
|
||||
- 0, 0, 0, 0);
|
||||
+ 0, 0, 0, 0, GNUTLS_FIPS140_OP_NOT_APPROVED);
|
||||
sign_verify_data(GNUTLS_SIGN_RSA_PSS_SHA256, pkey_rsa_pss,
|
||||
GNUTLS_PRIVKEY_FLAG_RSA_PSS_FIXED_SALT_LENGTH,
|
||||
0,
|
||||
GNUTLS_E_CONSTRAINT_ERROR,
|
||||
- 0);
|
||||
+ 0,
|
||||
+ /* The error is caught before calling the actual
|
||||
+ * signing operation.
|
||||
+ */
|
||||
+ GNUTLS_FIPS140_OP_INITIAL);
|
||||
sign_verify_data(GNUTLS_SIGN_RSA_PSS_SHA256, pkey_rsa_pss,
|
||||
0,
|
||||
GNUTLS_VERIFY_RSA_PSS_FIXED_SALT_LENGTH,
|
||||
0,
|
||||
- GNUTLS_E_PK_SIG_VERIFY_FAILED);
|
||||
+ GNUTLS_E_PK_SIG_VERIFY_FAILED,
|
||||
+ GNUTLS_FIPS140_OP_NOT_APPROVED);
|
||||
|
||||
assert(gnutls_x509_spki_init(&spki)>=0);
|
||||
gnutls_x509_spki_set_rsa_pss_params(spki, GNUTLS_DIG_SHA256, 48);
|
||||
assert(gnutls_privkey_set_spki(pkey_rsa, spki, 0)>=0);
|
||||
|
||||
- sign_verify_data(GNUTLS_SIGN_RSA_PSS_RSAE_SHA256, pkey_rsa, 0, 0, 0, 0);
|
||||
+ sign_verify_data(GNUTLS_SIGN_RSA_PSS_RSAE_SHA256, pkey_rsa, 0, 0, 0, 0,
|
||||
+ GNUTLS_FIPS140_OP_NOT_APPROVED);
|
||||
sign_verify_data(GNUTLS_SIGN_RSA_PSS_RSAE_SHA256, pkey_rsa,
|
||||
GNUTLS_PRIVKEY_FLAG_RSA_PSS_FIXED_SALT_LENGTH,
|
||||
0,
|
||||
GNUTLS_E_CONSTRAINT_ERROR,
|
||||
- 0);
|
||||
+ 0,
|
||||
+ /* The error is caught before calling the actual
|
||||
+ * signing operation.
|
||||
+ */
|
||||
+ GNUTLS_FIPS140_OP_INITIAL);
|
||||
sign_verify_data(GNUTLS_SIGN_RSA_PSS_RSAE_SHA256, pkey_rsa,
|
||||
0,
|
||||
GNUTLS_VERIFY_RSA_PSS_FIXED_SALT_LENGTH,
|
||||
0,
|
||||
- GNUTLS_E_PK_SIG_VERIFY_FAILED);
|
||||
+ GNUTLS_E_PK_SIG_VERIFY_FAILED,
|
||||
+ GNUTLS_FIPS140_OP_NOT_APPROVED);
|
||||
|
||||
gnutls_privkey_deinit(pkey_rsa_pss);
|
||||
gnutls_privkey_deinit(pkey_rsa);
|
||||
gnutls_x509_spki_deinit(spki);
|
||||
|
||||
+ gnutls_fips140_context_deinit(fips_context);
|
||||
+
|
||||
gnutls_global_deinit();
|
||||
}
|
||||
--
|
||||
2.38.1
|
||||
|
|
@ -1,640 +0,0 @@
|
|||
From 036fb360e5775f01ef25f5e712024a29930c462e Mon Sep 17 00:00:00 2001
|
||||
From: Daiki Ueno <ueno@gnu.org>
|
||||
Date: Fri, 3 Jun 2022 15:43:00 +0900
|
||||
Subject: [PATCH] fips: provide function to manually run FIPS self-tests
|
||||
|
||||
FIPS140-3 IG 10.3.E Periodic Self-Testing says:
|
||||
|
||||
At security levels 1 and 2, acceptable means for initiating the
|
||||
periodic self-tests include a provided service, resetting, rebooting
|
||||
or power cycling.
|
||||
|
||||
Neither resetting, rebooting, nor power-cycling is suitable because
|
||||
those involve operations outside of the module. Therefore this patch
|
||||
adds a new API to manually run the substance of FIPS140 self-tests.
|
||||
|
||||
Suggeested by Richard Costa and Stephan Mueller in:
|
||||
https://gitlab.com/gnutls/gnutls/-/issues/1364
|
||||
|
||||
Signed-off-by: Daiki Ueno <ueno@gnu.org>
|
||||
---
|
||||
NEWS | 5 ++
|
||||
devel/libgnutls.abignore | 2 +
|
||||
devel/symbols.last | 2 +
|
||||
doc/Makefile.am | 2 +
|
||||
doc/manpages/Makefile.am | 1 +
|
||||
lib/fips.c | 139 ++++++++++++++++----------------
|
||||
lib/global.c | 14 +++-
|
||||
lib/includes/gnutls/gnutls.h.in | 2 +
|
||||
lib/libgnutls.map | 8 ++
|
||||
tests/fips-test.c | 7 ++
|
||||
10 files changed, 110 insertions(+), 72 deletions(-)
|
||||
|
||||
diff --git a/NEWS b/NEWS
|
||||
index 70dd8a12b5..389be8acaa 100644
|
||||
--- a/NEWS
|
||||
+++ b/NEWS
|
||||
@@ -5,6 +5,11 @@ Copyright (C) 2000-2016 Free Software Foundation, Inc.
|
||||
Copyright (C) 2013-2019 Nikos Mavrogiannopoulos
|
||||
See the end for copying conditions.
|
||||
|
||||
+* Version 3.7.7 (unreleased)
|
||||
+
|
||||
+** API and ABI modifications:
|
||||
+gnutls_fips140_run_self_tests: New function
|
||||
+
|
||||
* Version 3.7.6 (released 2022-05-27)
|
||||
|
||||
** libgnutls: Fixed invalid write when gnutls_realloc_zero()
|
||||
diff --git a/doc/Makefile.am b/doc/Makefile.am
|
||||
index d20a021d97..34ef43866c 100644
|
||||
--- a/doc/Makefile.am
|
||||
+++ b/doc/Makefile.am
|
||||
@@ -1096,6 +1096,8 @@ FUNCS += functions/gnutls_fips140_pop_context
|
||||
FUNCS += functions/gnutls_fips140_pop_context.short
|
||||
FUNCS += functions/gnutls_fips140_push_context
|
||||
FUNCS += functions/gnutls_fips140_push_context.short
|
||||
+FUNCS += functions/gnutls_fips140_run_self_tests
|
||||
+FUNCS += functions/gnutls_fips140_run_self_tests.short
|
||||
FUNCS += functions/gnutls_fips140_set_mode
|
||||
FUNCS += functions/gnutls_fips140_set_mode.short
|
||||
FUNCS += functions/gnutls_get_library_config
|
||||
diff --git a/doc/manpages/Makefile.am b/doc/manpages/Makefile.am
|
||||
index d8c5f2854d..90906b0574 100644
|
||||
--- a/doc/manpages/Makefile.am
|
||||
+++ b/doc/manpages/Makefile.am
|
||||
@@ -380,6 +380,7 @@ APIMANS += gnutls_fips140_get_operation_state.3
|
||||
APIMANS += gnutls_fips140_mode_enabled.3
|
||||
APIMANS += gnutls_fips140_pop_context.3
|
||||
APIMANS += gnutls_fips140_push_context.3
|
||||
+APIMANS += gnutls_fips140_run_self_tests.3
|
||||
APIMANS += gnutls_fips140_set_mode.3
|
||||
APIMANS += gnutls_get_library_config.3
|
||||
APIMANS += gnutls_get_system_config_file.3
|
||||
diff --git a/lib/fips.c b/lib/fips.c
|
||||
index e9c27f6df6..656d43e74a 100644
|
||||
--- a/lib/fips.c
|
||||
+++ b/lib/fips.c
|
||||
@@ -419,8 +419,6 @@ int _gnutls_fips_perform_self_checks1(void)
|
||||
{
|
||||
int ret;
|
||||
|
||||
- _gnutls_switch_lib_state(LIB_STATE_SELFTEST);
|
||||
-
|
||||
/* Tests the FIPS algorithms used by nettle internally.
|
||||
* In our case we test AES-CBC since nettle's AES is used by
|
||||
* the DRBG-AES.
|
||||
@@ -429,193 +427,153 @@ int _gnutls_fips_perform_self_checks1(void)
|
||||
/* ciphers - one test per cipher */
|
||||
ret = gnutls_cipher_self_test(0, GNUTLS_CIPHER_AES_128_CBC);
|
||||
if (ret < 0) {
|
||||
- gnutls_assert();
|
||||
- goto error;
|
||||
+ return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
}
|
||||
|
||||
return 0;
|
||||
-
|
||||
-error:
|
||||
- _gnutls_switch_lib_state(LIB_STATE_ERROR);
|
||||
- _gnutls_audit_log(NULL, "FIPS140-2 self testing part1 failed\n");
|
||||
-
|
||||
- return GNUTLS_E_SELF_TEST_ERROR;
|
||||
}
|
||||
|
||||
int _gnutls_fips_perform_self_checks2(void)
|
||||
{
|
||||
int ret;
|
||||
|
||||
- _gnutls_switch_lib_state(LIB_STATE_SELFTEST);
|
||||
-
|
||||
/* Tests the FIPS algorithms */
|
||||
|
||||
/* ciphers - one test per cipher */
|
||||
ret = gnutls_cipher_self_test(0, GNUTLS_CIPHER_3DES_CBC);
|
||||
if (ret < 0) {
|
||||
- gnutls_assert();
|
||||
- goto error;
|
||||
+ return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
}
|
||||
|
||||
ret = gnutls_cipher_self_test(0, GNUTLS_CIPHER_AES_256_CBC);
|
||||
if (ret < 0) {
|
||||
- gnutls_assert();
|
||||
- goto error;
|
||||
+ return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
}
|
||||
|
||||
ret = gnutls_cipher_self_test(0, GNUTLS_CIPHER_AES_256_GCM);
|
||||
if (ret < 0) {
|
||||
- gnutls_assert();
|
||||
- goto error;
|
||||
+ return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
}
|
||||
|
||||
ret = gnutls_cipher_self_test(0, GNUTLS_CIPHER_AES_256_XTS);
|
||||
if (ret < 0) {
|
||||
- gnutls_assert();
|
||||
- goto error;
|
||||
+ return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
}
|
||||
|
||||
ret = gnutls_cipher_self_test(0, GNUTLS_CIPHER_AES_256_CFB8);
|
||||
if (ret < 0) {
|
||||
- gnutls_assert();
|
||||
- goto error;
|
||||
+ return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
}
|
||||
|
||||
/* Digest tests */
|
||||
ret = gnutls_digest_self_test(0, GNUTLS_DIG_SHA3_224);
|
||||
if (ret < 0) {
|
||||
- gnutls_assert();
|
||||
- goto error;
|
||||
+ return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
}
|
||||
|
||||
ret = gnutls_digest_self_test(0, GNUTLS_DIG_SHA3_256);
|
||||
if (ret < 0) {
|
||||
- gnutls_assert();
|
||||
- goto error;
|
||||
+ return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
}
|
||||
|
||||
ret = gnutls_digest_self_test(0, GNUTLS_DIG_SHA3_384);
|
||||
if (ret < 0) {
|
||||
- gnutls_assert();
|
||||
- goto error;
|
||||
+ return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
}
|
||||
|
||||
ret = gnutls_digest_self_test(0, GNUTLS_DIG_SHA3_512);
|
||||
if (ret < 0) {
|
||||
- gnutls_assert();
|
||||
- goto error;
|
||||
+ return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
}
|
||||
|
||||
/* MAC (includes message digest test) */
|
||||
ret = gnutls_mac_self_test(0, GNUTLS_MAC_SHA1);
|
||||
if (ret < 0) {
|
||||
- gnutls_assert();
|
||||
- goto error;
|
||||
+ return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
}
|
||||
|
||||
ret = gnutls_mac_self_test(0, GNUTLS_MAC_SHA224);
|
||||
if (ret < 0) {
|
||||
- gnutls_assert();
|
||||
- goto error;
|
||||
+ return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
}
|
||||
|
||||
ret = gnutls_mac_self_test(0, GNUTLS_MAC_SHA256);
|
||||
if (ret < 0) {
|
||||
- gnutls_assert();
|
||||
- goto error;
|
||||
+ return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
}
|
||||
|
||||
ret = gnutls_mac_self_test(0, GNUTLS_MAC_SHA384);
|
||||
if (ret < 0) {
|
||||
- gnutls_assert();
|
||||
- goto error;
|
||||
+ return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
}
|
||||
|
||||
ret = gnutls_mac_self_test(0, GNUTLS_MAC_SHA512);
|
||||
if (ret < 0) {
|
||||
- gnutls_assert();
|
||||
- goto error;
|
||||
+ return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
}
|
||||
|
||||
ret = gnutls_mac_self_test(0, GNUTLS_MAC_AES_CMAC_256);
|
||||
if (ret < 0) {
|
||||
- gnutls_assert();
|
||||
- goto error;
|
||||
+ return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
}
|
||||
|
||||
/* PK */
|
||||
ret = gnutls_pk_self_test(0, GNUTLS_PK_RSA);
|
||||
if (ret < 0) {
|
||||
- gnutls_assert();
|
||||
- goto error;
|
||||
+ return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
}
|
||||
|
||||
ret = gnutls_pk_self_test(0, GNUTLS_PK_DSA);
|
||||
if (ret < 0) {
|
||||
- gnutls_assert();
|
||||
- goto error;
|
||||
+ return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
}
|
||||
|
||||
ret = gnutls_pk_self_test(0, GNUTLS_PK_EC);
|
||||
if (ret < 0) {
|
||||
- gnutls_assert();
|
||||
- goto error;
|
||||
+ return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
}
|
||||
|
||||
ret = gnutls_pk_self_test(0, GNUTLS_PK_DH);
|
||||
if (ret < 0) {
|
||||
- gnutls_assert();
|
||||
- goto error;
|
||||
+ return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
}
|
||||
|
||||
/* HKDF */
|
||||
ret = gnutls_hkdf_self_test(0, GNUTLS_MAC_SHA256);
|
||||
if (ret < 0) {
|
||||
- gnutls_assert();
|
||||
- goto error;
|
||||
+ return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
}
|
||||
|
||||
/* PBKDF2 */
|
||||
ret = gnutls_pbkdf2_self_test(0, GNUTLS_MAC_SHA256);
|
||||
if (ret < 0) {
|
||||
- gnutls_assert();
|
||||
- goto error;
|
||||
+ return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
}
|
||||
|
||||
/* TLS-PRF */
|
||||
ret = gnutls_tlsprf_self_test(0, GNUTLS_MAC_SHA256);
|
||||
if (ret < 0) {
|
||||
- gnutls_assert();
|
||||
- goto error;
|
||||
+ return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
}
|
||||
|
||||
if (_gnutls_rnd_ops.self_test == NULL) {
|
||||
- gnutls_assert();
|
||||
- goto error;
|
||||
+ return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
}
|
||||
|
||||
/* this does not require rng initialization */
|
||||
ret = _gnutls_rnd_ops.self_test();
|
||||
if (ret < 0) {
|
||||
- gnutls_assert();
|
||||
- goto error;
|
||||
+ return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
}
|
||||
|
||||
if (_skip_integrity_checks == 0) {
|
||||
ret = check_binary_integrity();
|
||||
if (ret < 0) {
|
||||
- gnutls_assert();
|
||||
- goto error;
|
||||
+ return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
|
||||
}
|
||||
}
|
||||
|
||||
return 0;
|
||||
-
|
||||
-error:
|
||||
- _gnutls_switch_lib_state(LIB_STATE_ERROR);
|
||||
- _gnutls_audit_log(NULL, "FIPS140-2 self testing part 2 failed\n");
|
||||
-
|
||||
- return GNUTLS_E_SELF_TEST_ERROR;
|
||||
}
|
||||
#endif
|
||||
|
||||
@@ -894,3 +852,48 @@ _gnutls_switch_fips_state(gnutls_fips140_operation_state_t state)
|
||||
(void)state;
|
||||
#endif
|
||||
}
|
||||
+
|
||||
+/**
|
||||
+ * gnutls_fips140_run_self_tests:
|
||||
+ *
|
||||
+ * Manually perform the second round of the FIPS140 self-tests,
|
||||
+ * including:
|
||||
+ *
|
||||
+ * - Known answer tests (KAT) for the selected set of symmetric
|
||||
+ * cipher, MAC, public key, KDF, and DRBG
|
||||
+ * - Library integrity checks
|
||||
+ *
|
||||
+ * Upon failure with FIPS140 mode enabled, it makes the library
|
||||
+ * unusable. This function is not thread-safe.
|
||||
+ *
|
||||
+ * Returns: 0 upon success, a negative error code otherwise
|
||||
+ *
|
||||
+ * Since: 3.7.7
|
||||
+ */
|
||||
+int
|
||||
+gnutls_fips140_run_self_tests(void)
|
||||
+{
|
||||
+#ifdef ENABLE_FIPS140
|
||||
+ int ret;
|
||||
+ unsigned prev_lib_state;
|
||||
+
|
||||
+ /* Temporarily switch to LIB_STATE_SELFTEST as some of the
|
||||
+ * algorithms are implemented using special constructs in
|
||||
+ * self-tests (such as deterministic variants) */
|
||||
+ prev_lib_state = _gnutls_get_lib_state();
|
||||
+ _gnutls_switch_lib_state(LIB_STATE_SELFTEST);
|
||||
+
|
||||
+ ret = _gnutls_fips_perform_self_checks2();
|
||||
+ if (gnutls_fips140_mode_enabled() != GNUTLS_FIPS140_DISABLED &&
|
||||
+ ret < 0) {
|
||||
+ _gnutls_switch_lib_state(LIB_STATE_ERROR);
|
||||
+ _gnutls_audit_log(NULL, "FIPS140-2 self testing part 2 failed\n");
|
||||
+ } else {
|
||||
+ /* Restore the previous library state */
|
||||
+ _gnutls_switch_lib_state(prev_lib_state);
|
||||
+ }
|
||||
+ return ret;
|
||||
+#else
|
||||
+ return 0;
|
||||
+#endif
|
||||
+}
|
||||
diff --git a/lib/global.c b/lib/global.c
|
||||
index faa7f0afb2..1b372c15bd 100644
|
||||
--- a/lib/global.c
|
||||
+++ b/lib/global.c
|
||||
@@ -336,9 +336,12 @@ static int _gnutls_global_init(unsigned constructor)
|
||||
|
||||
/* first round of self checks, these are done on the
|
||||
* nettle algorithms which are used internally */
|
||||
+ _gnutls_switch_lib_state(LIB_STATE_SELFTEST);
|
||||
ret = _gnutls_fips_perform_self_checks1();
|
||||
- if (res != 2) {
|
||||
- if (ret < 0) {
|
||||
+ if (ret < 0) {
|
||||
+ _gnutls_switch_lib_state(LIB_STATE_ERROR);
|
||||
+ _gnutls_audit_log(NULL, "FIPS140-2 self testing part1 failed\n");
|
||||
+ if (res != 2) {
|
||||
gnutls_assert();
|
||||
goto out;
|
||||
}
|
||||
@@ -355,9 +358,12 @@ static int _gnutls_global_init(unsigned constructor)
|
||||
* (e.g., AESNI overridden AES). They are after _gnutls_register_accel_crypto()
|
||||
* intentionally */
|
||||
if (res != 0) {
|
||||
+ _gnutls_switch_lib_state(LIB_STATE_SELFTEST);
|
||||
ret = _gnutls_fips_perform_self_checks2();
|
||||
- if (res != 2) {
|
||||
- if (ret < 0) {
|
||||
+ if (ret < 0) {
|
||||
+ _gnutls_switch_lib_state(LIB_STATE_ERROR);
|
||||
+ _gnutls_audit_log(NULL, "FIPS140-2 self testing part 2 failed\n");
|
||||
+ if (res != 2) {
|
||||
gnutls_assert();
|
||||
goto out;
|
||||
}
|
||||
diff --git a/lib/includes/gnutls/gnutls.h.in b/lib/includes/gnutls/gnutls.h.in
|
||||
index f7fc5d114a..5840f331e9 100644
|
||||
--- a/lib/includes/gnutls/gnutls.h.in
|
||||
+++ b/lib/includes/gnutls/gnutls.h.in
|
||||
@@ -3416,6 +3416,8 @@ gnutls_fips140_get_operation_state(gnutls_fips140_context_t context);
|
||||
int gnutls_fips140_push_context(gnutls_fips140_context_t context);
|
||||
int gnutls_fips140_pop_context(void);
|
||||
|
||||
+int gnutls_fips140_run_self_tests(void);
|
||||
+
|
||||
/* Gnutls error codes. The mapping to a TLS alert is also shown in
|
||||
* comments.
|
||||
*/
|
||||
diff --git a/lib/libgnutls.map b/lib/libgnutls.map
|
||||
index 0241946c8a..f42d5f9fae 100644
|
||||
--- a/lib/libgnutls.map
|
||||
+++ b/lib/libgnutls.map
|
||||
@@ -1399,6 +1399,14 @@ GNUTLS_3_7_5
|
||||
*;
|
||||
} GNUTLS_3_7_4;
|
||||
|
||||
+GNUTLS_3_7_7
|
||||
+{
|
||||
+ global:
|
||||
+ gnutls_fips140_run_self_tests;
|
||||
+ local:
|
||||
+ *;
|
||||
+} GNUTLS_3_7_5;
|
||||
+
|
||||
GNUTLS_FIPS140_3_4 {
|
||||
global:
|
||||
gnutls_cipher_self_test;
|
||||
diff --git a/tests/fips-test.c b/tests/fips-test.c
|
||||
index a6a283fa67..31a5e26111 100644
|
||||
--- a/tests/fips-test.c
|
||||
+++ b/tests/fips-test.c
|
||||
@@ -525,6 +525,13 @@ void doit(void)
|
||||
}
|
||||
|
||||
gnutls_fips140_context_deinit(fips_context);
|
||||
+
|
||||
+ /* run self-tests manually */
|
||||
+ ret = gnutls_fips140_run_self_tests();
|
||||
+ if (ret < 0) {
|
||||
+ fail("gnutls_fips140_run_self_tests failed\n");
|
||||
+ }
|
||||
+
|
||||
gnutls_global_deinit();
|
||||
return;
|
||||
}
|
||||
--
|
||||
2.36.1
|
||||
|
||||
From 354027c0c09db60d3083fa48ae791046d336957b Mon Sep 17 00:00:00 2001
|
||||
From: Alexander Sosedkin <asosedkin@redhat.com>
|
||||
Date: Tue, 28 Jun 2022 17:22:36 +0200
|
||||
Subject: [PATCH] tests/fips-test: minor extension
|
||||
|
||||
Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
|
||||
---
|
||||
tests/fips-test.c | 36 +++++++++++++++++++++++++++---------
|
||||
1 file changed, 27 insertions(+), 9 deletions(-)
|
||||
|
||||
diff --git a/tests/fips-test.c b/tests/fips-test.c
|
||||
index 31a5e26111..f9bd34586a 100644
|
||||
--- a/tests/fips-test.c
|
||||
+++ b/tests/fips-test.c
|
||||
@@ -427,34 +427,43 @@ void doit(void)
|
||||
rsa_import_keypair(&privkey, &pubkey, "rsa-2432.pem");
|
||||
FIPS_POP_CONTEXT(INITIAL);
|
||||
|
||||
- /* Create a signature with SHA256; approved */
|
||||
+ /* Create a signature with 2432-bit RSA and SHA256; approved */
|
||||
FIPS_PUSH_CONTEXT();
|
||||
ret = gnutls_privkey_sign_data(privkey, GNUTLS_DIG_SHA256, 0,
|
||||
&data, &signature);
|
||||
if (ret < 0) {
|
||||
fail("gnutls_privkey_sign_data failed\n");
|
||||
}
|
||||
- gnutls_free(signature.data);
|
||||
FIPS_POP_CONTEXT(APPROVED);
|
||||
|
||||
- /* Create a signature with SHA-1; not approved */
|
||||
+ /* Verify a signature with 2432-bit RSA and SHA256; approved */
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ ret = gnutls_pubkey_verify_data2(pubkey, GNUTLS_SIGN_RSA_SHA256, 0,
|
||||
+ &data, &signature);
|
||||
+ if (ret < 0) {
|
||||
+ fail("gnutls_pubkey_verify_data2 failed\n");
|
||||
+ }
|
||||
+ FIPS_POP_CONTEXT(APPROVED);
|
||||
+ gnutls_free(signature.data);
|
||||
+
|
||||
+ /* Create a signature with 2432-bit RSA and SHA-1; not approved */
|
||||
FIPS_PUSH_CONTEXT();
|
||||
ret = gnutls_privkey_sign_data(privkey, GNUTLS_DIG_SHA1, 0,
|
||||
&data, &signature);
|
||||
if (ret < 0) {
|
||||
fail("gnutls_privkey_sign_data failed\n");
|
||||
}
|
||||
- gnutls_free(signature.data);
|
||||
FIPS_POP_CONTEXT(NOT_APPROVED);
|
||||
|
||||
- /* Verify a signature created with SHA-1; approved */
|
||||
+ /* Verify a signature created with 2432-bit RSA and SHA-1; approved */
|
||||
FIPS_PUSH_CONTEXT();
|
||||
- ret = gnutls_pubkey_verify_data2(pubkey, GNUTLS_SIGN_RSA_SHA1, 0, &data,
|
||||
- &rsa2342_sha1_sig);
|
||||
+ ret = gnutls_pubkey_verify_data2(pubkey, GNUTLS_SIGN_RSA_SHA1, 0,
|
||||
+ &data, &rsa2342_sha1_sig);
|
||||
if (ret < 0) {
|
||||
fail("gnutls_pubkey_verify_data2 failed\n");
|
||||
}
|
||||
FIPS_POP_CONTEXT(APPROVED);
|
||||
+ gnutls_free(signature.data);
|
||||
gnutls_pubkey_deinit(pubkey);
|
||||
gnutls_privkey_deinit(privkey);
|
||||
|
||||
@@ -463,15 +472,24 @@ void doit(void)
|
||||
rsa_import_keypair(&privkey, &pubkey, "rsa-512.pem");
|
||||
FIPS_POP_CONTEXT(INITIAL);
|
||||
|
||||
- /* Create a signature; not approved */
|
||||
+ /* Create a signature with 512-bit RSA and SHA256; not approved */
|
||||
FIPS_PUSH_CONTEXT();
|
||||
ret = gnutls_privkey_sign_data(privkey, GNUTLS_DIG_SHA256, 0,
|
||||
&data, &signature);
|
||||
if (ret < 0) {
|
||||
fail("gnutls_privkey_sign_data failed\n");
|
||||
}
|
||||
- gnutls_free(signature.data);
|
||||
FIPS_POP_CONTEXT(NOT_APPROVED);
|
||||
+
|
||||
+ /* Verify a signature with 512-bit RSA and SHA256; not approved */
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ ret = gnutls_pubkey_verify_data2(pubkey, GNUTLS_SIGN_RSA_SHA256, 0,
|
||||
+ &data, &signature);
|
||||
+ if (ret < 0) {
|
||||
+ fail("gnutls_pubkey_verify_data2 failed\n");
|
||||
+ }
|
||||
+ FIPS_POP_CONTEXT(NOT_APPROVED);
|
||||
+ gnutls_free(signature.data);
|
||||
gnutls_pubkey_deinit(pubkey);
|
||||
gnutls_privkey_deinit(privkey);
|
||||
|
||||
--
|
||||
2.37.3
|
||||
|
||||
From 5a745120148861d873f47c1428c8c6dcadcf109b Mon Sep 17 00:00:00 2001
|
||||
From: Richard Costa <richard.costa@suse.com>
|
||||
Date: Sat, 9 Jul 2022 00:50:21 +0000
|
||||
Subject: [PATCH] Add self-test code inside a FIPS context
|
||||
|
||||
Self-test code exercise lots of different FIPS-related code with
|
||||
side-effects. So, in order to prevent it from losing information when
|
||||
executing inside another context, we create an appropriated one.
|
||||
|
||||
If the self-test fails, then the library is placed in error state, so it
|
||||
doesn't matter for other contexts.
|
||||
|
||||
Signed-off-by: Richard Maciel Costa <richard.costa@suse.com>
|
||||
---
|
||||
lib/fips.c | 19 +++++++++++++++++++
|
||||
tests/fips-test.c | 20 ++++++++++++--------
|
||||
2 files changed, 31 insertions(+), 8 deletions(-)
|
||||
|
||||
diff --git a/lib/fips.c b/lib/fips.c
|
||||
index 31a52a990f..7d143e608e 100644
|
||||
--- a/lib/fips.c
|
||||
+++ b/lib/fips.c
|
||||
@@ -902,6 +902,16 @@ gnutls_fips140_run_self_tests(void)
|
||||
#ifdef ENABLE_FIPS140
|
||||
int ret;
|
||||
unsigned prev_lib_state;
|
||||
+ gnutls_fips140_context_t fips_context = NULL;
|
||||
+
|
||||
+ /* Save the FIPS context, because self tests change it */
|
||||
+ if (gnutls_fips140_mode_enabled() != GNUTLS_FIPS140_DISABLED) {
|
||||
+ if (gnutls_fips140_context_init(&fips_context) < 0 ||
|
||||
+ gnutls_fips140_push_context(fips_context) < 0) {
|
||||
+ gnutls_fips140_context_deinit(fips_context);
|
||||
+ fips_context = NULL;
|
||||
+ }
|
||||
+ }
|
||||
|
||||
/* Temporarily switch to LIB_STATE_SELFTEST as some of the
|
||||
* algorithms are implemented using special constructs in
|
||||
@@ -918,6 +928,15 @@ gnutls_fips140_run_self_tests(void)
|
||||
/* Restore the previous library state */
|
||||
_gnutls_switch_lib_state(prev_lib_state);
|
||||
}
|
||||
+
|
||||
+ /* Restore the previous FIPS context */
|
||||
+ if (gnutls_fips140_mode_enabled() != GNUTLS_FIPS140_DISABLED && fips_context) {
|
||||
+ if (gnutls_fips140_pop_context() < 0) {
|
||||
+ _gnutls_switch_lib_state(LIB_STATE_ERROR);
|
||||
+ _gnutls_audit_log(NULL, "FIPS140-2 context restoration failed\n");
|
||||
+ }
|
||||
+ gnutls_fips140_context_deinit(fips_context);
|
||||
+ }
|
||||
return ret;
|
||||
#else
|
||||
return 0;
|
||||
diff --git a/tests/fips-test.c b/tests/fips-test.c
|
||||
index f9bd34586a..475b739197 100644
|
||||
--- a/tests/fips-test.c
|
||||
+++ b/tests/fips-test.c
|
||||
@@ -457,8 +457,9 @@ void doit(void)
|
||||
|
||||
/* Verify a signature created with 2432-bit RSA and SHA-1; approved */
|
||||
FIPS_PUSH_CONTEXT();
|
||||
- ret = gnutls_pubkey_verify_data2(pubkey, GNUTLS_SIGN_RSA_SHA1, 0,
|
||||
- &data, &rsa2342_sha1_sig);
|
||||
+ ret = gnutls_pubkey_verify_data2(pubkey, GNUTLS_SIGN_RSA_SHA1,
|
||||
+ GNUTLS_VERIFY_ALLOW_SIGN_WITH_SHA1, &data,
|
||||
+ &rsa2342_sha1_sig);
|
||||
if (ret < 0) {
|
||||
fail("gnutls_pubkey_verify_data2 failed\n");
|
||||
}
|
||||
@@ -501,6 +502,15 @@ void doit(void)
|
||||
}
|
||||
FIPS_POP_CONTEXT(APPROVED);
|
||||
|
||||
+ /* run self-tests manually */
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ ret = gnutls_rnd(GNUTLS_RND_RANDOM, key16, sizeof(key16));
|
||||
+ ret = gnutls_fips140_run_self_tests();
|
||||
+ if (ret < 0) {
|
||||
+ fail("gnutls_fips140_run_self_tests failed\n");
|
||||
+ }
|
||||
+ FIPS_POP_CONTEXT(APPROVED);
|
||||
+
|
||||
/* Test when FIPS140 is set to error state */
|
||||
_gnutls_lib_simulate_error();
|
||||
|
||||
@@ -544,12 +554,6 @@ void doit(void)
|
||||
|
||||
gnutls_fips140_context_deinit(fips_context);
|
||||
|
||||
- /* run self-tests manually */
|
||||
- ret = gnutls_fips140_run_self_tests();
|
||||
- if (ret < 0) {
|
||||
- fail("gnutls_fips140_run_self_tests failed\n");
|
||||
- }
|
||||
-
|
||||
gnutls_global_deinit();
|
||||
return;
|
||||
}
|
||||
--
|
||||
2.37.3
|
||||
|
|
@ -1,407 +0,0 @@
|
|||
From e8b35d31817d207d8b4b87ccf104d3b93aa446e0 Mon Sep 17 00:00:00 2001
|
||||
From: Daiki Ueno <ueno@gnu.org>
|
||||
Date: Mon, 17 Oct 2022 11:11:43 +0900
|
||||
Subject: [PATCH] tests: move FIPS service indicator functions to common file
|
||||
|
||||
Signed-off-by: Daiki Ueno <ueno@gnu.org>
|
||||
---
|
||||
tests/dh-compute.c | 36 +++++---------------------
|
||||
tests/fips-rsa-sizes.c | 24 -----------------
|
||||
tests/fips-test.c | 27 +++-----------------
|
||||
tests/kdf-api.c | 27 +-------------------
|
||||
tests/pkcs12_encode.c | 24 -----------------
|
||||
tests/privkey-keygen.c | 24 -----------------
|
||||
tests/utils.h | 58 ++++++++++++++++++++++++++++++++++++++++++
|
||||
7 files changed, 69 insertions(+), 151 deletions(-)
|
||||
|
||||
diff --git a/tests/dh-compute.c b/tests/dh-compute.c
|
||||
index 828fb05e9c..6c1d5328f6 100644
|
||||
--- a/tests/dh-compute.c
|
||||
+++ b/tests/dh-compute.c
|
||||
@@ -156,34 +156,10 @@ void doit(void)
|
||||
{ NULL }
|
||||
};
|
||||
|
||||
-#define FIPS_PUSH_CONTEXT() do { \
|
||||
- if (gnutls_fips140_mode_enabled()) { \
|
||||
- ret = gnutls_fips140_push_context(fips_context); \
|
||||
- if (ret < 0) { \
|
||||
- fail("gnutls_fips140_push_context failed\n"); \
|
||||
- } \
|
||||
- } \
|
||||
-} while (0)
|
||||
-
|
||||
-#define FIPS_POP_CONTEXT(state) do { \
|
||||
- if (gnutls_fips140_mode_enabled()) { \
|
||||
- ret = gnutls_fips140_pop_context(); \
|
||||
- if (ret < 0) { \
|
||||
- fail("gnutls_fips140_context_pop failed\n"); \
|
||||
- } \
|
||||
- fips_state = gnutls_fips140_get_operation_state(fips_context); \
|
||||
- if (fips_state != state) { \
|
||||
- fail("operation state is not %d (%d)\n", \
|
||||
- state, fips_state); \
|
||||
- } \
|
||||
- } \
|
||||
-} while (0)
|
||||
-
|
||||
for (int i = 0; test_data[i].name != NULL; i++) {
|
||||
gnutls_datum_t priv_key, pub_key;
|
||||
gnutls_dh_params_t dh_params;
|
||||
gnutls_fips140_context_t fips_context;
|
||||
- gnutls_fips140_operation_state_t fips_state;
|
||||
int ret;
|
||||
|
||||
if (gnutls_fips140_mode_enabled()) {
|
||||
@@ -193,24 +169,24 @@ void doit(void)
|
||||
}
|
||||
}
|
||||
|
||||
- FIPS_PUSH_CONTEXT();
|
||||
+ fips_push_context(fips_context);
|
||||
params(&dh_params, &test_data[i].prime, &test_data[i].q,
|
||||
&test_data[i].generator);
|
||||
- FIPS_POP_CONTEXT(GNUTLS_FIPS140_OP_INITIAL);
|
||||
+ fips_pop_context(fips_context, GNUTLS_FIPS140_OP_INITIAL);
|
||||
|
||||
success("%s genkey\n", test_data[i].name);
|
||||
|
||||
- FIPS_PUSH_CONTEXT();
|
||||
+ fips_push_context(fips_context);
|
||||
genkey(dh_params, &priv_key, &pub_key);
|
||||
- FIPS_POP_CONTEXT(test_data[i].fips_state_genkey);
|
||||
+ fips_pop_context(fips_context, test_data[i].fips_state_genkey);
|
||||
|
||||
success("%s compute_key\n", test_data[i].name);
|
||||
|
||||
- FIPS_PUSH_CONTEXT();
|
||||
+ fips_push_context(fips_context);
|
||||
compute_key(test_data[i].name, dh_params, &priv_key,
|
||||
&pub_key, &test_data[i].peer_key,
|
||||
test_data[i].expected_error, NULL, 0);
|
||||
- FIPS_POP_CONTEXT(test_data[i].fips_state_compute_key);
|
||||
+ fips_pop_context(fips_context, test_data[i].fips_state_compute_key);
|
||||
|
||||
gnutls_dh_params_deinit(dh_params);
|
||||
gnutls_free(priv_key.data);
|
||||
diff --git a/tests/fips-rsa-sizes.c b/tests/fips-rsa-sizes.c
|
||||
index 84b9affabb..5feb284503 100644
|
||||
--- a/tests/fips-rsa-sizes.c
|
||||
+++ b/tests/fips-rsa-sizes.c
|
||||
@@ -27,25 +27,6 @@
|
||||
#include <gnutls/abstract.h>
|
||||
#include <gnutls/x509.h>
|
||||
|
||||
-#define FIPS_PUSH_CONTEXT() do { \
|
||||
- ret = gnutls_fips140_push_context(fips_context); \
|
||||
- if (ret < 0) { \
|
||||
- fail("gnutls_fips140_push_context failed\n"); \
|
||||
- } \
|
||||
-} while (0)
|
||||
-
|
||||
-#define FIPS_POP_CONTEXT(state) do { \
|
||||
- ret = gnutls_fips140_pop_context(); \
|
||||
- if (ret < 0) { \
|
||||
- fail("gnutls_fips140_context_pop failed\n"); \
|
||||
- } \
|
||||
- fips_state = gnutls_fips140_get_operation_state(fips_context); \
|
||||
- if (fips_state != GNUTLS_FIPS140_OP_ ## state) { \
|
||||
- fail("operation state is not " # state " (%d)\n", \
|
||||
- fips_state); \
|
||||
- } \
|
||||
-} while (0)
|
||||
-
|
||||
|
||||
void generate_successfully(gnutls_privkey_t* privkey, gnutls_pubkey_t* pubkey,
|
||||
unsigned int size);
|
||||
@@ -63,7 +44,6 @@ void generate_successfully(gnutls_privkey_t* privkey, gnutls_pubkey_t* pubkey,
|
||||
int ret;
|
||||
gnutls_x509_privkey_t xprivkey;
|
||||
gnutls_fips140_context_t fips_context;
|
||||
- gnutls_fips140_operation_state_t fips_state;
|
||||
assert(gnutls_fips140_context_init(&fips_context) == 0);
|
||||
|
||||
fprintf(stderr, "%d-bit\n", size);
|
||||
@@ -102,7 +82,6 @@ void generate_unsuccessfully(gnutls_privkey_t* privkey, gnutls_pubkey_t* pubkey,
|
||||
int ret;
|
||||
gnutls_x509_privkey_t xprivkey;
|
||||
gnutls_fips140_context_t fips_context;
|
||||
- gnutls_fips140_operation_state_t fips_state;
|
||||
assert(gnutls_fips140_context_init(&fips_context) == 0);
|
||||
|
||||
fprintf(stderr, "%d-bit\n", size);
|
||||
@@ -156,7 +135,6 @@ void generate_unsuccessfully(gnutls_privkey_t* privkey, gnutls_pubkey_t* pubkey,
|
||||
void sign_verify_successfully(gnutls_privkey_t privkey, gnutls_pubkey_t pubkey) {
|
||||
int ret;
|
||||
gnutls_fips140_context_t fips_context;
|
||||
- gnutls_fips140_operation_state_t fips_state;
|
||||
|
||||
gnutls_datum_t signature;
|
||||
gnutls_datum_t plaintext = {
|
||||
@@ -190,7 +168,6 @@ void sign_verify_unsuccessfully(gnutls_privkey_t privkey,
|
||||
gnutls_pubkey_t pubkey) {
|
||||
int ret;
|
||||
gnutls_fips140_context_t fips_context;
|
||||
- gnutls_fips140_operation_state_t fips_state;
|
||||
|
||||
gnutls_datum_t signature;
|
||||
gnutls_datum_t plaintext = {
|
||||
@@ -225,7 +202,6 @@ void sign_verify_unsuccessfully(gnutls_privkey_t privkey,
|
||||
void nosign_verify(gnutls_privkey_t privkey, gnutls_pubkey_t pubkey) {
|
||||
int ret;
|
||||
gnutls_fips140_context_t fips_context;
|
||||
- gnutls_fips140_operation_state_t fips_state;
|
||||
|
||||
gnutls_datum_t signature;
|
||||
gnutls_datum_t plaintext = {
|
||||
diff --git a/tests/fips-test.c b/tests/fips-test.c
|
||||
index f789afb107..b0bae4ef9f 100644
|
||||
--- a/tests/fips-test.c
|
||||
+++ b/tests/fips-test.c
|
||||
@@ -12,25 +12,6 @@
|
||||
/* This does check the FIPS140 support.
|
||||
*/
|
||||
|
||||
-#define FIPS_PUSH_CONTEXT() do { \
|
||||
- ret = gnutls_fips140_push_context(fips_context); \
|
||||
- if (ret < 0) { \
|
||||
- fail("gnutls_fips140_push_context failed\n"); \
|
||||
- } \
|
||||
-} while (0)
|
||||
-
|
||||
-#define FIPS_POP_CONTEXT(state) do { \
|
||||
- ret = gnutls_fips140_pop_context(); \
|
||||
- if (ret < 0) { \
|
||||
- fail("gnutls_fips140_context_pop failed\n"); \
|
||||
- } \
|
||||
- fips_state = gnutls_fips140_get_operation_state(fips_context); \
|
||||
- if (fips_state != GNUTLS_FIPS140_OP_ ## state) { \
|
||||
- fail("operation state is not " # state " (%d)\n", \
|
||||
- fips_state); \
|
||||
- } \
|
||||
-} while (0)
|
||||
-
|
||||
void _gnutls_lib_simulate_error(void);
|
||||
|
||||
static void tls_log_func(int level, const char *str)
|
||||
@@ -40,10 +21,9 @@ static void tls_log_func(int level, const char *str)
|
||||
|
||||
static uint8_t key16[16];
|
||||
static uint8_t iv16[16];
|
||||
-uint8_t key_data[64];
|
||||
-uint8_t iv_data[16];
|
||||
-gnutls_fips140_context_t fips_context;
|
||||
-gnutls_fips140_operation_state_t fips_state;
|
||||
+static uint8_t key_data[64];
|
||||
+static uint8_t iv_data[16];
|
||||
+static gnutls_fips140_context_t fips_context;
|
||||
|
||||
static const gnutls_datum_t data = { .data = (unsigned char *)"foo", 3 };
|
||||
static const uint8_t rsa2342_sha1_sig_data[] = {
|
||||
@@ -276,6 +256,7 @@ test_ciphers(void)
|
||||
void doit(void)
|
||||
{
|
||||
int ret;
|
||||
+ gnutls_fips140_operation_state_t fips_state;
|
||||
unsigned int mode;
|
||||
gnutls_cipher_hd_t ch;
|
||||
gnutls_hmac_hd_t mh;
|
||||
diff --git a/tests/kdf-api.c b/tests/kdf-api.c
|
||||
index 9724502005..a28ce82a62 100644
|
||||
--- a/tests/kdf-api.c
|
||||
+++ b/tests/kdf-api.c
|
||||
@@ -33,30 +33,7 @@
|
||||
#define MAX_BUF 1024
|
||||
|
||||
static gnutls_fips140_context_t fips_context;
|
||||
-static gnutls_fips140_operation_state_t fips_state;
|
||||
-
|
||||
-#define FIPS_PUSH_CONTEXT() do { \
|
||||
- if (gnutls_fips140_mode_enabled()) { \
|
||||
- ret = gnutls_fips140_push_context(fips_context); \
|
||||
- if (ret < 0) { \
|
||||
- fail("gnutls_fips140_push_context failed\n"); \
|
||||
- } \
|
||||
- } \
|
||||
-} while (0)
|
||||
-
|
||||
-#define FIPS_POP_CONTEXT(state) do { \
|
||||
- if (gnutls_fips140_mode_enabled()) { \
|
||||
- ret = gnutls_fips140_pop_context(); \
|
||||
- if (ret < 0) { \
|
||||
- fail("gnutls_fips140_context_pop failed\n"); \
|
||||
- } \
|
||||
- fips_state = gnutls_fips140_get_operation_state(fips_context); \
|
||||
- if (fips_state != GNUTLS_FIPS140_OP_ ## state) { \
|
||||
- fail("operation state is not " # state " (%d)\n", \
|
||||
- fips_state); \
|
||||
- } \
|
||||
- } \
|
||||
-} while (0)
|
||||
+
|
||||
|
||||
static void
|
||||
test_hkdf(gnutls_mac_algorithm_t mac,
|
||||
@@ -74,7 +51,6 @@ test_hkdf(gnutls_mac_algorithm_t mac,
|
||||
gnutls_datum_t prk;
|
||||
gnutls_datum_t okm;
|
||||
uint8_t buf[MAX_BUF];
|
||||
- int ret;
|
||||
|
||||
success("HKDF test with %s\n", gnutls_mac_get_name(mac));
|
||||
|
||||
@@ -144,7 +120,6 @@ test_pbkdf2(gnutls_mac_algorithm_t mac,
|
||||
gnutls_datum_t salt;
|
||||
gnutls_datum_t okm;
|
||||
uint8_t buf[MAX_BUF];
|
||||
- int ret;
|
||||
|
||||
success("PBKDF2 test with %s\n", gnutls_mac_get_name(mac));
|
||||
|
||||
diff --git a/tests/pkcs12_encode.c b/tests/pkcs12_encode.c
|
||||
index ea39f3d69e..dc55daccde 100644
|
||||
--- a/tests/pkcs12_encode.c
|
||||
+++ b/tests/pkcs12_encode.c
|
||||
@@ -70,29 +70,6 @@ static void tls_log_func(int level, const char *str)
|
||||
fprintf(stderr, "|<%d>| %s", level, str);
|
||||
}
|
||||
|
||||
-#define FIPS_PUSH_CONTEXT() do { \
|
||||
- if (gnutls_fips140_mode_enabled()) { \
|
||||
- ret = gnutls_fips140_push_context(fips_context); \
|
||||
- if (ret < 0) { \
|
||||
- fail("gnutls_fips140_push_context failed\n"); \
|
||||
- } \
|
||||
- } \
|
||||
-} while (0)
|
||||
-
|
||||
-#define FIPS_POP_CONTEXT(state) do { \
|
||||
- if (gnutls_fips140_mode_enabled()) { \
|
||||
- ret = gnutls_fips140_pop_context(); \
|
||||
- if (ret < 0) { \
|
||||
- fail("gnutls_fips140_context_pop failed\n"); \
|
||||
- } \
|
||||
- fips_state = gnutls_fips140_get_operation_state(fips_context); \
|
||||
- if (fips_state != GNUTLS_FIPS140_OP_ ## state) { \
|
||||
- fail("operation state is not " # state " (%d)\n", \
|
||||
- fips_state); \
|
||||
- } \
|
||||
- } \
|
||||
-} while (0)
|
||||
-
|
||||
void doit(void)
|
||||
{
|
||||
gnutls_pkcs12_t pkcs12;
|
||||
@@ -106,7 +83,6 @@ void doit(void)
|
||||
size_t size;
|
||||
unsigned i;
|
||||
gnutls_fips140_context_t fips_context;
|
||||
- gnutls_fips140_operation_state_t fips_state;
|
||||
size_t n_tests = 0;
|
||||
struct tests {
|
||||
const char *name;
|
||||
diff --git a/tests/privkey-keygen.c b/tests/privkey-keygen.c
|
||||
index 2766afee08..2531906d71 100644
|
||||
--- a/tests/privkey-keygen.c
|
||||
+++ b/tests/privkey-keygen.c
|
||||
@@ -119,30 +119,6 @@ void doit(void)
|
||||
gnutls_x509_privkey_t pkey, dst;
|
||||
int ret, algorithm, i;
|
||||
gnutls_fips140_context_t fips_context;
|
||||
- gnutls_fips140_operation_state_t fips_state;
|
||||
-
|
||||
-#define FIPS_PUSH_CONTEXT() do { \
|
||||
- if (gnutls_fips140_mode_enabled()) { \
|
||||
- ret = gnutls_fips140_push_context(fips_context); \
|
||||
- if (ret < 0) { \
|
||||
- fail("gnutls_fips140_push_context failed\n"); \
|
||||
- } \
|
||||
- } \
|
||||
-} while (0)
|
||||
-
|
||||
-#define FIPS_POP_CONTEXT(state) do { \
|
||||
- if (gnutls_fips140_mode_enabled()) { \
|
||||
- ret = gnutls_fips140_pop_context(); \
|
||||
- if (ret < 0) { \
|
||||
- fail("gnutls_fips140_context_pop failed\n"); \
|
||||
- } \
|
||||
- fips_state = gnutls_fips140_get_operation_state(fips_context); \
|
||||
- if (fips_state != GNUTLS_FIPS140_OP_ ## state) { \
|
||||
- fail("operation state is not " # state " (%d)\n", \
|
||||
- fips_state); \
|
||||
- } \
|
||||
- } \
|
||||
-} while (0)
|
||||
|
||||
ret = global_init();
|
||||
if (ret < 0)
|
||||
diff --git a/tests/utils.h b/tests/utils.h
|
||||
index d3a2ba8d16..4433a07057 100644
|
||||
--- a/tests/utils.h
|
||||
+++ b/tests/utils.h
|
||||
@@ -210,4 +210,62 @@ inline static unsigned int get_dtls_retransmit_timeout(void) {
|
||||
return (unsigned int) ul;
|
||||
}
|
||||
|
||||
+static inline const char *
|
||||
+fips_operation_state_to_string(gnutls_fips140_operation_state_t state)
|
||||
+{
|
||||
+ switch (state) {
|
||||
+ case GNUTLS_FIPS140_OP_INITIAL:
|
||||
+ return "INITIAL";
|
||||
+ case GNUTLS_FIPS140_OP_APPROVED:
|
||||
+ return "APPROVED";
|
||||
+ case GNUTLS_FIPS140_OP_NOT_APPROVED:
|
||||
+ return "NOT_APPROVED";
|
||||
+ case GNUTLS_FIPS140_OP_ERROR:
|
||||
+ return "ERROR";
|
||||
+ default:
|
||||
+ /*NOTREACHED*/
|
||||
+ assert(0);
|
||||
+ return NULL;
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
+static inline void
|
||||
+fips_push_context(gnutls_fips140_context_t context)
|
||||
+{
|
||||
+ if (gnutls_fips140_mode_enabled()) {
|
||||
+ int ret;
|
||||
+
|
||||
+ ret = gnutls_fips140_push_context(context);
|
||||
+ if (ret < 0) {
|
||||
+ fail("gnutls_fips140_push_context failed\n");
|
||||
+ }
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
+static inline void
|
||||
+fips_pop_context(gnutls_fips140_context_t context,
|
||||
+ gnutls_fips140_operation_state_t expected_state)
|
||||
+{
|
||||
+ gnutls_fips140_operation_state_t state;
|
||||
+
|
||||
+ if (gnutls_fips140_mode_enabled()) {
|
||||
+ int ret;
|
||||
+
|
||||
+ ret = gnutls_fips140_pop_context();
|
||||
+ if (ret < 0) {
|
||||
+ fail("gnutls_fips140_context_pop failed\n");
|
||||
+ }
|
||||
+ state = gnutls_fips140_get_operation_state(context);
|
||||
+ if (state != expected_state) {
|
||||
+ fail("operation state is not %s (%s)\n",
|
||||
+ fips_operation_state_to_string(expected_state),
|
||||
+ fips_operation_state_to_string(state));
|
||||
+ }
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
+/* To use those convenient macros, define fips_context variable. */
|
||||
+#define FIPS_PUSH_CONTEXT() fips_push_context(fips_context)
|
||||
+#define FIPS_POP_CONTEXT(state) fips_pop_context(fips_context, GNUTLS_FIPS140_OP_ ## state)
|
||||
+
|
||||
#endif /* GNUTLS_TESTS_UTILS_H */
|
||||
--
|
||||
2.38.1
|
||||
|
|
@ -1,310 +0,0 @@
|
|||
From f8a8961cfa176fc74c153cb6e1e68aff5e2d42f2 Mon Sep 17 00:00:00 2001
|
||||
From: rpm-build <rpm-build>
|
||||
Date: Tue, 27 Sep 2022 10:52:19 +0900
|
||||
Subject: [PATCH] gnutls-3.7.6-fips-symkey-limit.patch
|
||||
|
||||
---
|
||||
lib/crypto-api.c | 26 ++++++++++++++++++++++---
|
||||
tests/fips-test.c | 49 +++++++++++++++++++++++++++++++++++++++++++++++
|
||||
tests/kdf-api.c | 9 ++++++++-
|
||||
3 files changed, 80 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/lib/crypto-api.c b/lib/crypto-api.c
|
||||
index b3e1eec..35200fb 100644
|
||||
--- a/lib/crypto-api.c
|
||||
+++ b/lib/crypto-api.c
|
||||
@@ -896,6 +896,7 @@ gnutls_hash_hd_t gnutls_hash_copy(gnutls_hash_hd_t handle)
|
||||
int gnutls_key_generate(gnutls_datum_t * key, unsigned int key_size)
|
||||
{
|
||||
int ret;
|
||||
+ bool not_approved = false;
|
||||
|
||||
FAIL_IF_LIB_ERROR;
|
||||
|
||||
@@ -912,17 +913,31 @@ int gnutls_key_generate(gnutls_datum_t * key, unsigned int key_size)
|
||||
key->data = gnutls_malloc(key->size);
|
||||
if (!key->data) {
|
||||
gnutls_assert();
|
||||
- return GNUTLS_E_MEMORY_ERROR;
|
||||
+ ret = GNUTLS_E_MEMORY_ERROR;
|
||||
+ goto error;
|
||||
+ }
|
||||
+
|
||||
+ /* Key lengths of less than 112 bits are not approved */
|
||||
+ if (key_size < 14) {
|
||||
+ not_approved = true;
|
||||
}
|
||||
|
||||
ret = gnutls_rnd(GNUTLS_RND_RANDOM, key->data, key->size);
|
||||
if (ret < 0) {
|
||||
gnutls_assert();
|
||||
_gnutls_free_datum(key);
|
||||
- return ret;
|
||||
+ goto error;
|
||||
}
|
||||
|
||||
- return 0;
|
||||
+ error:
|
||||
+ if (ret < 0) {
|
||||
+ _gnutls_switch_fips_state(GNUTLS_FIPS140_OP_ERROR);
|
||||
+ } else if (not_approved) {
|
||||
+ _gnutls_switch_fips_state(GNUTLS_FIPS140_OP_NOT_APPROVED);
|
||||
+ } else {
|
||||
+ _gnutls_switch_fips_state(GNUTLS_FIPS140_OP_APPROVED);
|
||||
+ }
|
||||
+ return ret;
|
||||
}
|
||||
|
||||
/* AEAD API */
|
||||
@@ -2058,6 +2073,11 @@ gnutls_pbkdf2(gnutls_mac_algorithm_t mac,
|
||||
not_approved = true;
|
||||
}
|
||||
|
||||
+ /* Key lengths and output sizes of less than 112 bits are not approved */
|
||||
+ if (key->size < 14 || length < 14) {
|
||||
+ not_approved = true;
|
||||
+ }
|
||||
+
|
||||
ret = _gnutls_kdf_ops.pbkdf2(mac, key->data, key->size,
|
||||
salt->data, salt->size, iter_count,
|
||||
output, length);
|
||||
diff --git a/tests/fips-test.c b/tests/fips-test.c
|
||||
index 31a5e26..27da414 100644
|
||||
--- a/tests/fips-test.c
|
||||
+++ b/tests/fips-test.c
|
||||
@@ -274,6 +274,8 @@ void doit(void)
|
||||
gnutls_datum_t signature;
|
||||
unsigned int bits;
|
||||
uint8_t hmac[64];
|
||||
+ uint8_t pbkdf2[64];
|
||||
+ gnutls_datum_t temp_key = { NULL, 0 };
|
||||
|
||||
fprintf(stderr,
|
||||
"Please note that if in FIPS140 mode, you need to assure the library's integrity prior to running this test\n");
|
||||
@@ -371,11 +373,58 @@ void doit(void)
|
||||
}
|
||||
FIPS_POP_CONTEXT(NOT_APPROVED);
|
||||
|
||||
+ /* PBKDF2 with key equal to or longer than 112 bits: approved */
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ ret = gnutls_pbkdf2(GNUTLS_MAC_SHA256, &key, &iv, 100,
|
||||
+ &pbkdf2, sizeof(pbkdf2));
|
||||
+ if (ret < 0) {
|
||||
+ fail("gnutls_pbkdf2 failed\n");
|
||||
+ }
|
||||
+ FIPS_POP_CONTEXT(APPROVED);
|
||||
+
|
||||
+ /* PBKDF2 with key shorter than 112 bits: not approved */
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ key.size = 13;
|
||||
+ ret = gnutls_pbkdf2(GNUTLS_MAC_SHA256, &key, &iv, 100,
|
||||
+ &pbkdf2, sizeof(pbkdf2));
|
||||
+ if (ret < 0) {
|
||||
+ fail("gnutls_pbkdf2 failed\n");
|
||||
+ }
|
||||
+ key.size = sizeof(key16);
|
||||
+ FIPS_POP_CONTEXT(NOT_APPROVED);
|
||||
+
|
||||
+ /* PBKDF2 with output shorter than 112 bits: not approved */
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ ret = gnutls_pbkdf2(GNUTLS_MAC_SHA256, &key, &iv, 100,
|
||||
+ &pbkdf2, 13);
|
||||
+ if (ret < 0) {
|
||||
+ fail("gnutls_pbkdf2 failed\n");
|
||||
+ }
|
||||
+ FIPS_POP_CONTEXT(NOT_APPROVED);
|
||||
+
|
||||
ret = gnutls_rnd(GNUTLS_RND_NONCE, key16, sizeof(key16));
|
||||
if (ret < 0) {
|
||||
fail("gnutls_rnd failed\n");
|
||||
}
|
||||
|
||||
+ /* Symmetric key generation equal to or longer than 112 bits: approved */
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ ret = gnutls_key_generate(&temp_key, 14);
|
||||
+ if (ret < 0) {
|
||||
+ fail("gnutls_key_generate failed\n");
|
||||
+ }
|
||||
+ gnutls_free(temp_key.data);
|
||||
+ FIPS_POP_CONTEXT(APPROVED);
|
||||
+
|
||||
+ /* Symmetric key generation shorter than 112 bits: not approved */
|
||||
+ FIPS_PUSH_CONTEXT();
|
||||
+ ret = gnutls_key_generate(&temp_key, 13);
|
||||
+ if (ret < 0) {
|
||||
+ fail("gnutls_key_generate failed\n");
|
||||
+ }
|
||||
+ gnutls_free(temp_key.data);
|
||||
+ FIPS_POP_CONTEXT(NOT_APPROVED);
|
||||
+
|
||||
ret = gnutls_pubkey_init(&pubkey);
|
||||
if (ret < 0) {
|
||||
fail("gnutls_pubkey_init failed\n");
|
||||
diff --git a/tests/kdf-api.c b/tests/kdf-api.c
|
||||
index 25fbc6a..8a4677c 100644
|
||||
--- a/tests/kdf-api.c
|
||||
+++ b/tests/kdf-api.c
|
||||
@@ -89,6 +89,7 @@ test_hkdf(gnutls_mac_algorithm_t mac,
|
||||
|
||||
FIPS_PUSH_CONTEXT();
|
||||
assert(gnutls_hkdf_extract(mac, &ikm, &salt, buf) >= 0);
|
||||
+ /* HKDF outside of TLS usage is not approved */
|
||||
FIPS_POP_CONTEXT(NOT_APPROVED);
|
||||
gnutls_free(ikm.data);
|
||||
gnutls_free(salt.data);
|
||||
@@ -110,6 +111,7 @@ test_hkdf(gnutls_mac_algorithm_t mac,
|
||||
|
||||
FIPS_PUSH_CONTEXT();
|
||||
assert(gnutls_hkdf_expand(mac, &prk, &info, buf, length) >= 0);
|
||||
+ /* HKDF outside of TLS usage is not approved */
|
||||
FIPS_POP_CONTEXT(NOT_APPROVED);
|
||||
gnutls_free(info.data);
|
||||
|
||||
@@ -151,7 +153,12 @@ test_pbkdf2(gnutls_mac_algorithm_t mac,
|
||||
|
||||
FIPS_PUSH_CONTEXT();
|
||||
assert(gnutls_pbkdf2(mac, &ikm, &salt, iter_count, buf, length) >= 0);
|
||||
- FIPS_POP_CONTEXT(APPROVED);
|
||||
+ /* Key sizes and output sizes less than 112-bit are not approved. */
|
||||
+ if (ikm.size < 14 || length < 14) {
|
||||
+ FIPS_POP_CONTEXT(NOT_APPROVED);
|
||||
+ } else {
|
||||
+ FIPS_POP_CONTEXT(APPROVED);
|
||||
+ }
|
||||
gnutls_free(ikm.data);
|
||||
gnutls_free(salt.data);
|
||||
|
||||
--
|
||||
2.37.3
|
||||
|
||||
From 86eded166f77612c70201c0d85d3abe711edd77d Mon Sep 17 00:00:00 2001
|
||||
From: Daiki Ueno <ueno@gnu.org>
|
||||
Date: Thu, 29 Sep 2022 21:19:26 +0900
|
||||
Subject: [PATCH] fips: only mark HMAC as approved in PBKDF2
|
||||
|
||||
As ACVP only allows HMAC used with PBKDF2[1], this change marks other
|
||||
hash algorithms not-approved.
|
||||
|
||||
1. https://pages.nist.gov/ACVP/draft-celi-acvp-pbkdf.html
|
||||
|
||||
Signed-off-by: Daiki Ueno <ueno@gnu.org>
|
||||
---
|
||||
lib/crypto-api.c | 5 ++++-
|
||||
lib/fips.h | 16 +++++++++++++++-
|
||||
tests/kdf-api.c | 30 +++++++++++++++++++++++++++++-
|
||||
3 files changed, 48 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/lib/crypto-api.c b/lib/crypto-api.c
|
||||
index d3e601ab3a..9f7e18db11 100644
|
||||
--- a/lib/crypto-api.c
|
||||
+++ b/lib/crypto-api.c
|
||||
@@ -2229,7 +2229,10 @@ gnutls_pbkdf2(gnutls_mac_algorithm_t mac,
|
||||
if (!is_mac_algo_allowed(mac)) {
|
||||
_gnutls_switch_fips_state(GNUTLS_FIPS140_OP_ERROR);
|
||||
return gnutls_assert_val(GNUTLS_E_UNWANTED_ALGORITHM);
|
||||
- } else if (!is_mac_algo_approved_in_fips(mac)) {
|
||||
+ } else if (!is_mac_algo_hmac_approved_in_fips(mac)) {
|
||||
+ /* ACVP only allows HMAC used with PBKDF2:
|
||||
+ * https://pages.nist.gov/ACVP/draft-celi-acvp-pbkdf.html
|
||||
+ */
|
||||
not_approved = true;
|
||||
}
|
||||
|
||||
diff --git a/lib/fips.h b/lib/fips.h
|
||||
index 3a74f254e7..bf61b36741 100644
|
||||
--- a/lib/fips.h
|
||||
+++ b/lib/fips.h
|
||||
@@ -76,7 +76,7 @@ void _gnutls_lib_simulate_error(void);
|
||||
void _gnutls_lib_force_operational(void);
|
||||
|
||||
inline static bool
|
||||
-is_mac_algo_approved_in_fips(gnutls_mac_algorithm_t algo)
|
||||
+is_mac_algo_hmac_approved_in_fips(gnutls_mac_algorithm_t algo)
|
||||
{
|
||||
switch (algo) {
|
||||
case GNUTLS_MAC_SHA1:
|
||||
@@ -88,6 +88,20 @@ is_mac_algo_approved_in_fips(gnutls_mac_algorithm_t algo)
|
||||
case GNUTLS_MAC_SHA3_256:
|
||||
case GNUTLS_MAC_SHA3_384:
|
||||
case GNUTLS_MAC_SHA3_512:
|
||||
+ return true;
|
||||
+ default:
|
||||
+ return false;
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
+inline static bool
|
||||
+is_mac_algo_approved_in_fips(gnutls_mac_algorithm_t algo)
|
||||
+{
|
||||
+ if (is_mac_algo_hmac_approved_in_fips(algo)) {
|
||||
+ return true;
|
||||
+ }
|
||||
+
|
||||
+ switch (algo) {
|
||||
case GNUTLS_MAC_AES_CMAC_128:
|
||||
case GNUTLS_MAC_AES_CMAC_256:
|
||||
case GNUTLS_MAC_AES_GMAC_128:
|
||||
diff --git a/tests/kdf-api.c b/tests/kdf-api.c
|
||||
index 577cbf7a17..4feb22688b 100644
|
||||
--- a/tests/kdf-api.c
|
||||
+++ b/tests/kdf-api.c
|
||||
@@ -26,6 +26,7 @@
|
||||
#include <gnutls/crypto.h>
|
||||
|
||||
#include <assert.h>
|
||||
+#include <stdbool.h>
|
||||
#include <stdint.h>
|
||||
|
||||
#include "utils.h"
|
||||
@@ -133,6 +134,25 @@ test_hkdf(gnutls_mac_algorithm_t mac,
|
||||
gnutls_free(hex.data);
|
||||
}
|
||||
|
||||
+inline static bool
|
||||
+is_mac_algo_hmac_approved_in_fips(gnutls_mac_algorithm_t algo)
|
||||
+{
|
||||
+ switch (algo) {
|
||||
+ case GNUTLS_MAC_SHA1:
|
||||
+ case GNUTLS_MAC_SHA256:
|
||||
+ case GNUTLS_MAC_SHA384:
|
||||
+ case GNUTLS_MAC_SHA512:
|
||||
+ case GNUTLS_MAC_SHA224:
|
||||
+ case GNUTLS_MAC_SHA3_224:
|
||||
+ case GNUTLS_MAC_SHA3_256:
|
||||
+ case GNUTLS_MAC_SHA3_384:
|
||||
+ case GNUTLS_MAC_SHA3_512:
|
||||
+ return true;
|
||||
+ default:
|
||||
+ return false;
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
static void
|
||||
test_pbkdf2(gnutls_mac_algorithm_t mac,
|
||||
const char *ikm_hex,
|
||||
@@ -161,7 +181,8 @@ test_pbkdf2(gnutls_mac_algorithm_t mac,
|
||||
FIPS_PUSH_CONTEXT();
|
||||
assert(gnutls_pbkdf2(mac, &ikm, &salt, iter_count, buf, length) >= 0);
|
||||
/* Key sizes and output sizes less than 112-bit are not approved. */
|
||||
- if (ikm.size < 14 || length < 14) {
|
||||
+ if (ikm.size < 14 || length < 14 ||
|
||||
+ !is_mac_algo_hmac_approved_in_fips(mac)) {
|
||||
FIPS_POP_CONTEXT(NOT_APPROVED);
|
||||
} else {
|
||||
FIPS_POP_CONTEXT(APPROVED);
|
||||
@@ -208,5 +229,12 @@ doit(void)
|
||||
20,
|
||||
"4b007901b765489abead49d926f721d065a429c1");
|
||||
|
||||
+ test_pbkdf2(GNUTLS_MAC_AES_CMAC_128,
|
||||
+ "70617373776f726470617373776f7264", /* "passwordpassword" */
|
||||
+ "73616c74", /* "salt" */
|
||||
+ 4096,
|
||||
+ 20,
|
||||
+ "c4c112c6e1e3b8757640603dec78825ff87605a7");
|
||||
+
|
||||
gnutls_fips140_context_deinit(fips_context);
|
||||
}
|
||||
--
|
||||
2.37.3
|
||||
|
|
@ -1,175 +0,0 @@
|
|||
From: Daiki Ueno <ueno@gnu.org>
|
||||
Date: Fri, 19 Aug 2022 12:32:27 +0900
|
||||
Subject: [PATCH] build: allow GMP to be statically linked
|
||||
|
||||
Even though we set the custom allocator[1] to zeroize sensitive data,
|
||||
it can be easily invalidated if the application sets its own custom
|
||||
allocator. An approach to prevent that is to link against a static
|
||||
library of GMP, so the use of GMP is privatized and the custom
|
||||
allocator configuration is not shared with other applications.
|
||||
|
||||
This patch allows libgnutls to be linked with the static library of
|
||||
GMP. Note that, to this work libgmp.a needs to be compiled with -fPIC
|
||||
and libhogweed in Nettle is also linked to the static library of GMP.
|
||||
|
||||
1. https://gitlab.com/gnutls/gnutls/-/merge_requests/1554
|
||||
|
||||
Signed-off-by: Daiki Ueno <ueno@gnu.org>
|
||||
---
|
||||
diff --color -ruNp a/configure.ac b/configure.ac
|
||||
--- a/configure.ac 2022-12-15 11:06:16.782726043 +0100
|
||||
+++ b/configure.ac 2022-12-15 11:08:35.603451427 +0100
|
||||
@@ -744,6 +744,8 @@ AC_CHECK_FUNCS(nettle_cmac_kuznyechik_up
|
||||
LIBS=$save_LIBS
|
||||
|
||||
# Check sonames of the linked libraries needed for FIPS selftests.
|
||||
+save_CFLAGS=$CFLAGS
|
||||
+CFLAGS="$CFLAGS $GMP_CFLAGS"
|
||||
save_LIBS=$LIBS
|
||||
LIBS="$LIBS $GMP_LIBS"
|
||||
AC_MSG_CHECKING([gmp soname])
|
||||
@@ -757,9 +759,14 @@ if test -z "$gmp_so"; then
|
||||
gmp_so=none
|
||||
fi
|
||||
AC_MSG_RESULT($gmp_so)
|
||||
-AC_DEFINE_UNQUOTED([GMP_LIBRARY_SONAME], ["$gmp_so"], [The soname of gmp library])
|
||||
+if test "$gmp_so" != none; then
|
||||
+ AC_DEFINE_UNQUOTED([GMP_LIBRARY_SONAME], ["$gmp_so"], [The soname of gmp library])
|
||||
+fi
|
||||
LIBS=$save_LIBS
|
||||
+CFLAGS=$save_CFLAGS
|
||||
|
||||
+save_CFLAGS=$CFLAGS
|
||||
+CFLAGS="$CFLAGS $NETTLE_CFLAGS"
|
||||
save_LIBS=$LIBS
|
||||
LIBS="$LIBS $NETTLE_LIBS"
|
||||
AC_MSG_CHECKING([nettle soname])
|
||||
@@ -775,7 +782,11 @@ fi
|
||||
AC_MSG_RESULT($nettle_so)
|
||||
AC_DEFINE_UNQUOTED([NETTLE_LIBRARY_SONAME], ["$nettle_so"], [The soname of nettle library])
|
||||
LIBS=$save_LIBS
|
||||
+CFLAGS=$save_CFLAGS
|
||||
|
||||
+save_CFLAGS=$CFLAGS
|
||||
+# <nettle/bignum.h> includes <gmp.h>
|
||||
+CFLAGS="$CFLAGS $HOGWEED_CFLAGS $GMP_CFLAGS"
|
||||
save_LIBS=$LIBS
|
||||
LIBS="$LIBS $HOGWEED_LIBS"
|
||||
AC_MSG_CHECKING([hogweed soname])
|
||||
@@ -791,6 +802,7 @@ fi
|
||||
AC_MSG_RESULT($hogweed_so)
|
||||
AC_DEFINE_UNQUOTED([HOGWEED_LIBRARY_SONAME], ["$hogweed_so"], [The soname of hogweed library])
|
||||
LIBS=$save_LIBS
|
||||
+CFLAGS=$save_CFLAGS
|
||||
|
||||
gnutls_so=libgnutls.so.`expr "$LT_CURRENT" - "$LT_AGE"`
|
||||
AC_DEFINE_UNQUOTED([GNUTLS_LIBRARY_SONAME], ["$gnutls_so"], [The soname of gnutls library])
|
||||
diff --color -ruNp a/lib/fips.c b/lib/fips.c
|
||||
--- a/lib/fips.c 2022-12-15 11:06:16.868727731 +0100
|
||||
+++ b/lib/fips.c 2022-12-15 11:12:42.744303409 +0100
|
||||
@@ -155,7 +155,11 @@ void _gnutls_fips_mode_reset_zombie(void
|
||||
#define GNUTLS_LIBRARY_NAME GNUTLS_LIBRARY_SONAME
|
||||
#define NETTLE_LIBRARY_NAME NETTLE_LIBRARY_SONAME
|
||||
#define HOGWEED_LIBRARY_NAME HOGWEED_LIBRARY_SONAME
|
||||
+
|
||||
+/* GMP can be statically linked */
|
||||
+#ifdef GMP_LIBRARY_SONAME
|
||||
#define GMP_LIBRARY_NAME GMP_LIBRARY_SONAME
|
||||
+#endif
|
||||
|
||||
#define HMAC_SIZE 32
|
||||
#define HMAC_ALGO GNUTLS_MAC_SHA256
|
||||
@@ -173,7 +177,9 @@ struct hmac_file
|
||||
struct hmac_entry gnutls;
|
||||
struct hmac_entry nettle;
|
||||
struct hmac_entry hogweed;
|
||||
+#ifdef GMP_LIBRARY_SONAME
|
||||
struct hmac_entry gmp;
|
||||
+#endif
|
||||
};
|
||||
|
||||
struct lib_paths
|
||||
@@ -181,7 +187,9 @@ struct lib_paths
|
||||
char gnutls[GNUTLS_PATH_MAX];
|
||||
char nettle[GNUTLS_PATH_MAX];
|
||||
char hogweed[GNUTLS_PATH_MAX];
|
||||
+#ifdef GMP_LIBRARY_SONAME
|
||||
char gmp[GNUTLS_PATH_MAX];
|
||||
+#endif
|
||||
};
|
||||
|
||||
/*
|
||||
@@ -245,8 +253,10 @@ static int handler(void *user, const cha
|
||||
return lib_handler(&p->nettle, section, name, value);
|
||||
} else if (!strcmp(section, HOGWEED_LIBRARY_NAME)) {
|
||||
return lib_handler(&p->hogweed, section, name, value);
|
||||
+#ifdef GMP_LIBRARY_SONAME
|
||||
} else if (!strcmp(section, GMP_LIBRARY_NAME)) {
|
||||
return lib_handler(&p->gmp, section, name, value);
|
||||
+#endif
|
||||
} else {
|
||||
return 0;
|
||||
}
|
||||
@@ -389,8 +399,10 @@ static int callback(struct dl_phdr_info
|
||||
_gnutls_str_cpy(paths->nettle, GNUTLS_PATH_MAX, path);
|
||||
else if (!strcmp(soname, HOGWEED_LIBRARY_SONAME))
|
||||
_gnutls_str_cpy(paths->hogweed, GNUTLS_PATH_MAX, path);
|
||||
+#ifdef GMP_LIBRARY_SONAME
|
||||
else if (!strcmp(soname, GMP_LIBRARY_SONAME))
|
||||
_gnutls_str_cpy(paths->gmp, GNUTLS_PATH_MAX, path);
|
||||
+#endif
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -411,10 +423,12 @@ static int load_lib_paths(struct lib_pat
|
||||
_gnutls_debug_log("Hogweed library path was not found\n");
|
||||
return gnutls_assert_val(GNUTLS_E_FILE_ERROR);
|
||||
}
|
||||
+#ifdef GMP_LIBRARY_SONAME
|
||||
if (paths->gmp[0] == '\0') {
|
||||
_gnutls_debug_log("Gmp library path was not found\n");
|
||||
return gnutls_assert_val(GNUTLS_E_FILE_ERROR);
|
||||
}
|
||||
+#endif
|
||||
|
||||
return GNUTLS_E_SUCCESS;
|
||||
}
|
||||
@@ -467,9 +481,11 @@ static int check_binary_integrity(void)
|
||||
ret = check_lib_hmac(&hmac.hogweed, paths.hogweed);
|
||||
if (ret < 0)
|
||||
return ret;
|
||||
+#ifdef GMP_LIBRARY_SONAME
|
||||
ret = check_lib_hmac(&hmac.gmp, paths.gmp);
|
||||
if (ret < 0)
|
||||
return ret;
|
||||
+#endif
|
||||
|
||||
return 0;
|
||||
}
|
||||
diff --color -ruNp a/lib/fipshmac.c b/lib/fipshmac.c
|
||||
--- a/lib/fipshmac.c 2022-12-15 11:06:16.785726102 +0100
|
||||
+++ b/lib/fipshmac.c 2022-12-15 11:13:34.533320156 +0100
|
||||
@@ -107,8 +107,10 @@ static int callback(struct dl_phdr_info
|
||||
return print_lib(path, soname);
|
||||
if (!strcmp(soname, HOGWEED_LIBRARY_SONAME))
|
||||
return print_lib(path, soname);
|
||||
+#ifdef GMP_LIBRARY_SONAME
|
||||
if (!strcmp(soname, GMP_LIBRARY_SONAME))
|
||||
return print_lib(path, soname);
|
||||
+#endif
|
||||
return 0;
|
||||
}
|
||||
|
||||
diff --color -ruNp a/lib/global.c b/lib/global.c
|
||||
--- a/lib/global.c 2022-12-15 11:06:16.061711888 +0100
|
||||
+++ b/lib/global.c 2022-12-15 11:08:35.604451446 +0100
|
||||
@@ -540,7 +540,9 @@ static const struct gnutls_library_confi
|
||||
{ "libgnutls-soname", GNUTLS_LIBRARY_SONAME },
|
||||
{ "libnettle-soname", NETTLE_LIBRARY_SONAME },
|
||||
{ "libhogweed-soname", HOGWEED_LIBRARY_SONAME },
|
||||
+#ifdef GMP_LIBRARY_SONAME
|
||||
{ "libgmp-soname", GMP_LIBRARY_SONAME },
|
||||
+#endif
|
||||
{ "hardware-features", HW_FEATURES },
|
||||
{ "tls-features", TLS_FEATURES },
|
||||
{ NULL, NULL }
|
|
@ -1,124 +0,0 @@
|
|||
From f41151c8a218f255af08362b74cd6ee0dfd45c00 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Franti=C5=A1ek=20Kren=C5=BEelok?=
|
||||
<krenzelok.frantisek@gmail.com>
|
||||
Date: Tue, 14 Jun 2022 16:16:11 +0200
|
||||
Subject: [PATCH] KTLS: disable by default enable by config
|
||||
|
||||
KTLS will be disabled by default when build with `--enable-ktls` to
|
||||
enable it, use config file option `ktls = true` in [global] section.
|
||||
|
||||
Signed-off-by: Frantisek Krenzelok <krenzelok.frantisek@gmail.com>
|
||||
---
|
||||
doc/cha-config.texi | 18 ++++++++----------
|
||||
lib/gnutls_int.h | 2 +-
|
||||
lib/handshake.c | 2 +-
|
||||
lib/priority.c | 12 ++++++------
|
||||
4 files changed, 16 insertions(+), 18 deletions(-)
|
||||
|
||||
diff --git a/doc/cha-config.texi b/doc/cha-config.texi
|
||||
index e550f2e4b1..eaab7fd799 100644
|
||||
--- a/doc/cha-config.texi
|
||||
+++ b/doc/cha-config.texi
|
||||
@@ -26,7 +26,7 @@ used can be queried using @funcref{gnutls_get_system_config_file}.
|
||||
* Querying for disabled algorithms and protocols::
|
||||
* Overriding the parameter verification profile::
|
||||
* Overriding the default priority string::
|
||||
-* Disabling system/acceleration protocols::
|
||||
+* Enabling/Disabling system/acceleration protocols::
|
||||
@end menu
|
||||
|
||||
@node Application-specific priority strings
|
||||
@@ -253,16 +253,14 @@ default-priority-string = SECURE128:-VERS-TLS-ALL:+VERS-TLS1.3
|
||||
@end example
|
||||
|
||||
|
||||
-@node Disabling system/acceleration protocols
|
||||
-@section Disabling system/acceleration protocols
|
||||
-When system/acceleration protocol is enabled during build, it is usually
|
||||
-enabled by default. The following options can overwrite this behavior
|
||||
-system-wide.
|
||||
+@node Enabling/Disabling system/acceleration protocols
|
||||
+@section Enabling/Disabling system/acceleration protocols
|
||||
+The following options can overwrite default behavior of protocols system-wide.
|
||||
@example
|
||||
[global]
|
||||
-ktls = false
|
||||
+ktls = true
|
||||
|
||||
@end example
|
||||
-@subsection Disabling KTLS
|
||||
-When GnuTLS is build with -–enable-ktls configuration, it uses KTLS by default.
|
||||
-This can be overwritten by setting @code{ktls = false} in @code{[global]} section.
|
||||
+@subsection Enabling KTLS
|
||||
+When GnuTLS is build with -–enable-ktls configuration, KTLS is disabled by default.
|
||||
+This can be enabled by setting @code{ktls = true} in @code{[global]} section.
|
||||
diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h
|
||||
index 872188696b..8c7bdaa1db 100644
|
||||
--- a/lib/gnutls_int.h
|
||||
+++ b/lib/gnutls_int.h
|
||||
@@ -1649,6 +1649,6 @@ get_certificate_type(gnutls_session_t session,
|
||||
|
||||
extern unsigned int _gnutls_global_version;
|
||||
|
||||
-bool _gnutls_config_is_ktls_disabled(void);
|
||||
+bool _gnutls_config_is_ktls_enabled(void);
|
||||
|
||||
#endif /* GNUTLS_LIB_GNUTLS_INT_H */
|
||||
diff --git a/lib/handshake.c b/lib/handshake.c
|
||||
index f3edbbdacb..4dd457bf22 100644
|
||||
--- a/lib/handshake.c
|
||||
+++ b/lib/handshake.c
|
||||
@@ -2815,7 +2815,7 @@ int gnutls_handshake(gnutls_session_t session)
|
||||
|
||||
session->internals.ktls_enabled = 0;
|
||||
#ifdef ENABLE_KTLS
|
||||
- if (_gnutls_config_is_ktls_disabled() == false)
|
||||
+ if (_gnutls_config_is_ktls_enabled() == true)
|
||||
_gnutls_ktls_enable(session);
|
||||
#endif
|
||||
|
||||
diff --git a/lib/priority.c b/lib/priority.c
|
||||
index 7279c03c88..d163d8169f 100644
|
||||
--- a/lib/priority.c
|
||||
+++ b/lib/priority.c
|
||||
@@ -1027,7 +1027,7 @@ static void dummy_func(gnutls_priority_t c)
|
||||
|
||||
struct cfg {
|
||||
bool allowlisting;
|
||||
- bool ktls_disabled;
|
||||
+ bool ktls_enabled;
|
||||
|
||||
name_val_array_t priority_strings;
|
||||
char *priority_string;
|
||||
@@ -1140,7 +1140,7 @@ cfg_steal(struct cfg *dst, struct cfg *src)
|
||||
src->default_priority_string = NULL;
|
||||
|
||||
dst->allowlisting = src->allowlisting;
|
||||
- dst->ktls_disabled = src->ktls_disabled;
|
||||
+ dst->ktls_enabled = src->ktls_enabled;
|
||||
memcpy(dst->ciphers, src->ciphers, sizeof(src->ciphers));
|
||||
memcpy(dst->macs, src->macs, sizeof(src->macs));
|
||||
memcpy(dst->groups, src->groups, sizeof(src->groups));
|
||||
@@ -1268,8 +1268,8 @@ static int global_ini_handler(void *ctx, const char *section, const char *name,
|
||||
}
|
||||
} else if (c_strcasecmp(name, "ktls") == 0) {
|
||||
p = clear_spaces(value, str);
|
||||
- if (c_strcasecmp(p, "false") == 0) {
|
||||
- cfg->ktls_disabled = true;
|
||||
+ if (c_strcasecmp(p, "true") == 0) {
|
||||
+ cfg->ktls_enabled = true;
|
||||
} else {
|
||||
_gnutls_debug_log("cfg: unknown ktls mode %s\n",
|
||||
p);
|
||||
@@ -3490,6 +3490,6 @@ gnutls_priority_string_list(unsigned iter, unsigned int flags)
|
||||
return NULL;
|
||||
}
|
||||
|
||||
-bool _gnutls_config_is_ktls_disabled(void){
|
||||
- return system_wide_config.ktls_disabled;
|
||||
+bool _gnutls_config_is_ktls_enabled(void){
|
||||
+ return system_wide_config.ktls_enabled;
|
||||
}
|
||||
--
|
||||
2.36.1
|
||||
|
|
@ -1,348 +0,0 @@
|
|||
From 7b700dbcd5907944a7dd2f74cd26ad8586cd4bac Mon Sep 17 00:00:00 2001
|
||||
From: Daiki Ueno <ueno@gnu.org>
|
||||
Date: Tue, 28 Jun 2022 09:37:22 +0900
|
||||
Subject: [PATCH 1/3] tests: enable KTLS config while running gnutls_ktls test
|
||||
|
||||
Signed-off-by: Daiki Ueno <ueno@gnu.org>
|
||||
---
|
||||
tests/Makefile.am | 9 +++++----
|
||||
tests/gnutls_ktls.c | 4 ++--
|
||||
tests/ktls.sh | 46 +++++++++++++++++++++++++++++++++++++++++++++
|
||||
3 files changed, 53 insertions(+), 6 deletions(-)
|
||||
create mode 100755 tests/ktls.sh
|
||||
|
||||
diff --git a/tests/Makefile.am b/tests/Makefile.am
|
||||
index 4deeb6462b..cba67e8db8 100644
|
||||
--- a/tests/Makefile.am
|
||||
+++ b/tests/Makefile.am
|
||||
@@ -441,10 +441,6 @@ ctests += x509self x509dn anonself pskself pskself2 dhepskself \
|
||||
resume-with-record-size-limit
|
||||
endif
|
||||
|
||||
-if ENABLE_KTLS
|
||||
-ctests += gnutls_ktls
|
||||
-endif
|
||||
-
|
||||
ctests += record-sendfile
|
||||
|
||||
gc_CPPFLAGS = $(AM_CPPFLAGS) \
|
||||
@@ -500,6 +496,11 @@ if ENABLE_TPM2
|
||||
dist_check_SCRIPTS += tpm2.sh
|
||||
endif
|
||||
|
||||
+if ENABLE_KTLS
|
||||
+indirect_tests += gnutls_ktls
|
||||
+dist_check_SCRIPTS += ktls.sh
|
||||
+endif
|
||||
+
|
||||
if !WINDOWS
|
||||
|
||||
#
|
||||
diff --git a/tests/gnutls_ktls.c b/tests/gnutls_ktls.c
|
||||
index 3966e2b10a..8f9c5fa36e 100644
|
||||
--- a/tests/gnutls_ktls.c
|
||||
+++ b/tests/gnutls_ktls.c
|
||||
@@ -84,7 +84,7 @@ static void client(int fd, const char *prio)
|
||||
|
||||
ret = gnutls_transport_is_ktls_enabled(session);
|
||||
if (!(ret & GNUTLS_KTLS_RECV)){
|
||||
- fail("client: KTLS was not properly inicialized\n");
|
||||
+ fail("client: KTLS was not properly initialized\n");
|
||||
goto end;
|
||||
}
|
||||
|
||||
@@ -208,7 +208,7 @@ static void server(int fd, const char *prio)
|
||||
|
||||
ret = gnutls_transport_is_ktls_enabled(session);
|
||||
if (!(ret & GNUTLS_KTLS_SEND)){
|
||||
- fail("server: KTLS was not properly inicialized\n");
|
||||
+ fail("server: KTLS was not properly initialized\n");
|
||||
goto end;
|
||||
}
|
||||
do {
|
||||
diff --git a/tests/ktls.sh b/tests/ktls.sh
|
||||
new file mode 100755
|
||||
index 0000000000..ba52bd5775
|
||||
--- /dev/null
|
||||
+++ b/tests/ktls.sh
|
||||
@@ -0,0 +1,46 @@
|
||||
+#!/bin/sh
|
||||
+
|
||||
+# Copyright (C) 2022 Red Hat, Inc.
|
||||
+#
|
||||
+# Author: Daiki Ueno
|
||||
+#
|
||||
+# This file is part of GnuTLS.
|
||||
+#
|
||||
+# GnuTLS is free software; you can redistribute it and/or modify it
|
||||
+# under the terms of the GNU General Public License as published by the
|
||||
+# Free Software Foundation; either version 3 of the License, or (at
|
||||
+# your option) any later version.
|
||||
+#
|
||||
+# GnuTLS is distributed in the hope that it will be useful, but
|
||||
+# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
+# General Public License for more details.
|
||||
+#
|
||||
+# You should have received a copy of the GNU General Public License
|
||||
+# along with GnuTLS; if not, write to the Free Software Foundation,
|
||||
+# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
|
||||
+
|
||||
+: ${builddir=.}
|
||||
+
|
||||
+. "$srcdir/scripts/common.sh"
|
||||
+
|
||||
+if ! grep '^tls ' /proc/modules 2>1 >& /dev/null; then
|
||||
+ exit 77
|
||||
+fi
|
||||
+
|
||||
+testdir=`create_testdir ktls`
|
||||
+
|
||||
+cfg="$testdir/config"
|
||||
+
|
||||
+cat <<EOF > "$cfg"
|
||||
+[global]
|
||||
+ktls = true
|
||||
+EOF
|
||||
+
|
||||
+GNUTLS_SYSTEM_PRIORITY_FAIL_ON_INVALID=1 \
|
||||
+GNUTLS_SYSTEM_PRIORITY_FILE="$cfg" \
|
||||
+"$builddir/gnutls_ktls" "$@"
|
||||
+rc=$?
|
||||
+
|
||||
+rm -rf "$testdir"
|
||||
+exit $rc
|
||||
--
|
||||
2.36.1
|
||||
|
||||
|
||||
From 4a492462535a7f3a831685d3cf420b50ef219511 Mon Sep 17 00:00:00 2001
|
||||
From: Daiki Ueno <ueno@gnu.org>
|
||||
Date: Tue, 28 Jun 2022 10:23:33 +0900
|
||||
Subject: [PATCH 2/3] handshake: do not reset KTLS enablement in
|
||||
gnutls_handshake
|
||||
|
||||
As gnutls_handshake can be repeatedly called upon non-blocking setup,
|
||||
we shouldn't try to call setsockopt for KTLS upon every call.
|
||||
|
||||
Signed-off-by: Daiki Ueno <ueno@gnu.org>
|
||||
---
|
||||
lib/handshake.c | 12 ++++++------
|
||||
1 file changed, 6 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/lib/handshake.c b/lib/handshake.c
|
||||
index 4dd457bf22..3886306eb4 100644
|
||||
--- a/lib/handshake.c
|
||||
+++ b/lib/handshake.c
|
||||
@@ -2813,12 +2813,6 @@ int gnutls_handshake(gnutls_session_t session)
|
||||
const version_entry_st *vers = get_version(session);
|
||||
int ret;
|
||||
|
||||
- session->internals.ktls_enabled = 0;
|
||||
-#ifdef ENABLE_KTLS
|
||||
- if (_gnutls_config_is_ktls_enabled() == true)
|
||||
- _gnutls_ktls_enable(session);
|
||||
-#endif
|
||||
-
|
||||
if (unlikely(session->internals.initial_negotiation_completed)) {
|
||||
if (vers->tls13_sem) {
|
||||
if (session->security_parameters.entity == GNUTLS_CLIENT) {
|
||||
@@ -2864,6 +2858,12 @@ int gnutls_handshake(gnutls_session_t session)
|
||||
end->tv_nsec =
|
||||
(start->tv_nsec + tmo_ms * 1000000LL) % 1000000000LL;
|
||||
}
|
||||
+
|
||||
+#ifdef ENABLE_KTLS
|
||||
+ if (_gnutls_config_is_ktls_enabled()) {
|
||||
+ _gnutls_ktls_enable(session);
|
||||
+ }
|
||||
+#endif
|
||||
}
|
||||
|
||||
if (session->internals.recv_state == RECV_STATE_FALSE_START) {
|
||||
--
|
||||
2.36.1
|
||||
|
||||
|
||||
From ce13208e13b5dec73993c583d4c64ab7714e4a7a Mon Sep 17 00:00:00 2001
|
||||
From: Daiki Ueno <ueno@gnu.org>
|
||||
Date: Tue, 28 Jun 2022 10:53:55 +0900
|
||||
Subject: [PATCH 3/3] ktls: _gnutls_ktls_enable: fix GNUTLS_KTLS_SEND
|
||||
calculation
|
||||
|
||||
Previously, if the first setsockopt for GNUTLS_KTLS_RECV fails and the
|
||||
same socket is used for both sending and receiving, GNUTLS_KTLS_SEND
|
||||
was unconditionally set. This fixes the conditions and also adds more
|
||||
logging.
|
||||
|
||||
Signed-off-by: Daiki Ueno <ueno@gnu.org>
|
||||
---
|
||||
lib/system/ktls.c | 21 ++++++++++++++++-----
|
||||
1 file changed, 16 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/lib/system/ktls.c b/lib/system/ktls.c
|
||||
index b9f7a73fb5..ddf27fac76 100644
|
||||
--- a/lib/system/ktls.c
|
||||
+++ b/lib/system/ktls.c
|
||||
@@ -47,7 +47,7 @@
|
||||
gnutls_transport_ktls_enable_flags_t
|
||||
gnutls_transport_is_ktls_enabled(gnutls_session_t session){
|
||||
if (unlikely(!session->internals.initial_negotiation_completed)){
|
||||
- _gnutls_debug_log("Initial negotiation is not yet complete");
|
||||
+ _gnutls_debug_log("Initial negotiation is not yet complete\n");
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -57,16 +57,27 @@ gnutls_transport_is_ktls_enabled(gnutls_session_t session){
|
||||
void _gnutls_ktls_enable(gnutls_session_t session)
|
||||
{
|
||||
int sockin, sockout;
|
||||
+
|
||||
gnutls_transport_get_int2(session, &sockin, &sockout);
|
||||
|
||||
- if (setsockopt(sockin, SOL_TCP, TCP_ULP, "tls", sizeof ("tls")) == 0)
|
||||
+ if (setsockopt(sockin, SOL_TCP, TCP_ULP, "tls", sizeof ("tls")) == 0) {
|
||||
session->internals.ktls_enabled |= GNUTLS_KTLS_RECV;
|
||||
+ if (sockin == sockout) {
|
||||
+ session->internals.ktls_enabled |= GNUTLS_KTLS_SEND;
|
||||
+ }
|
||||
+ } else {
|
||||
+ _gnutls_record_log("Unable to set TCP_ULP for read socket: %d\n",
|
||||
+ errno);
|
||||
+ }
|
||||
|
||||
if (sockin != sockout) {
|
||||
- if (setsockopt(sockout, SOL_TCP, TCP_ULP, "tls", sizeof ("tls")) == 0)
|
||||
+ if (setsockopt(sockout, SOL_TCP, TCP_ULP, "tls", sizeof ("tls")) == 0) {
|
||||
session->internals.ktls_enabled |= GNUTLS_KTLS_SEND;
|
||||
- } else
|
||||
- session->internals.ktls_enabled |= GNUTLS_KTLS_SEND;
|
||||
+ } else {
|
||||
+ _gnutls_record_log("Unable to set TCP_ULP for write socket: %d\n",
|
||||
+ errno);
|
||||
+ }
|
||||
+ }
|
||||
}
|
||||
|
||||
int _gnutls_ktls_set_keys(gnutls_session_t session)
|
||||
--
|
||||
2.36.1
|
||||
|
||||
From 2d3cba6bb21acb40141180298f3924c73c7de8f8 Mon Sep 17 00:00:00 2001
|
||||
From: Daiki Ueno <ueno@gnu.org>
|
||||
Date: Tue, 26 Jul 2022 11:38:41 +0900
|
||||
Subject: [PATCH 1/2] handshake: do not enable KTLS if custom pull/push
|
||||
functions are set
|
||||
|
||||
If gnutls_transport_set_pull_function or
|
||||
gnutls_transport_set_push_function is used, we can't assume the
|
||||
underlying transport handle is an FD.
|
||||
|
||||
Signed-off-by: Daiki Ueno <ueno@gnu.org>
|
||||
---
|
||||
lib/handshake.c | 9 ++++++++-
|
||||
1 file changed, 8 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/lib/handshake.c b/lib/handshake.c
|
||||
index 3886306eb4..cf025a84f6 100644
|
||||
--- a/lib/handshake.c
|
||||
+++ b/lib/handshake.c
|
||||
@@ -2861,7 +2861,14 @@ int gnutls_handshake(gnutls_session_t session)
|
||||
|
||||
#ifdef ENABLE_KTLS
|
||||
if (_gnutls_config_is_ktls_enabled()) {
|
||||
- _gnutls_ktls_enable(session);
|
||||
+ if (session->internals.pull_func ||
|
||||
+ session->internals.push_func) {
|
||||
+ _gnutls_audit_log(session,
|
||||
+ "Not enabling KTLS with "
|
||||
+ "custom pull/push function\n");
|
||||
+ } else {
|
||||
+ _gnutls_ktls_enable(session);
|
||||
+ }
|
||||
}
|
||||
#endif
|
||||
}
|
||||
--
|
||||
2.37.1
|
||||
|
||||
|
||||
From f7160e4fb970b4ba6f96e85e21f8395eae735d95 Mon Sep 17 00:00:00 2001
|
||||
From: Daiki Ueno <ueno@gnu.org>
|
||||
Date: Tue, 26 Jul 2022 11:39:57 +0900
|
||||
Subject: [PATCH 2/2] socket: only set pull/push functions when --save-*-trace
|
||||
is used
|
||||
|
||||
This allows gnutls-cli to use KTLS for the transport, unless either
|
||||
--save-client-trace or --save-server-trace is used.
|
||||
|
||||
Signed-off-by: Daiki Ueno <ueno@gnu.org>
|
||||
---
|
||||
src/socket.c | 16 ++++++++--------
|
||||
1 file changed, 8 insertions(+), 8 deletions(-)
|
||||
|
||||
diff --git a/src/socket.c b/src/socket.c
|
||||
index 39f18dbe18..36ac292700 100644
|
||||
--- a/src/socket.c
|
||||
+++ b/src/socket.c
|
||||
@@ -586,16 +586,16 @@ socket_open2(socket_st * hd, const char *hostname, const char *service,
|
||||
gnutls_session_set_data(hd->session, hd->rdata.data, hd->rdata.size);
|
||||
}
|
||||
|
||||
- if (server_trace)
|
||||
+ if (client_trace || server_trace) {
|
||||
hd->server_trace = server_trace;
|
||||
-
|
||||
- if (client_trace)
|
||||
hd->client_trace = client_trace;
|
||||
-
|
||||
- gnutls_transport_set_push_function(hd->session, wrap_push);
|
||||
- gnutls_transport_set_pull_function(hd->session, wrap_pull);
|
||||
- gnutls_transport_set_pull_timeout_function(hd->session, wrap_pull_timeout_func);
|
||||
- gnutls_transport_set_ptr(hd->session, hd);
|
||||
+ gnutls_transport_set_push_function(hd->session, wrap_push);
|
||||
+ gnutls_transport_set_pull_function(hd->session, wrap_pull);
|
||||
+ gnutls_transport_set_pull_timeout_function(hd->session, wrap_pull_timeout_func);
|
||||
+ gnutls_transport_set_ptr(hd->session, hd);
|
||||
+ } else {
|
||||
+ gnutls_transport_set_int(hd->session, hd->fd);
|
||||
+ }
|
||||
}
|
||||
|
||||
if (!(flags & SOCKET_FLAG_RAW) && !(flags & SOCKET_FLAG_SKIP_INIT)) {
|
||||
--
|
||||
2.37.1
|
||||
|
||||
From a5b671fc9105cb5dbe6e6a1c0f39fa787d862076 Mon Sep 17 00:00:00 2001
|
||||
From: Frantisek Krenzelok <krenzelok.frantisek@gmail.com>
|
||||
Date: Fri, 29 Jul 2022 10:38:42 +0200
|
||||
Subject: [PATCH] KTLS: hotfix
|
||||
|
||||
session->internals.pull_func is set to system_read during gnutls_init()
|
||||
so check for user set pull/push function added in commit mentioned
|
||||
bellow will never pass.
|
||||
|
||||
source: 2d3cba6bb21acb40141180298f3924c73c7de8f8
|
||||
|
||||
Signed-off-by: Frantisek Krenzelok <krenzelok.frantisek@gmail.com>
|
||||
---
|
||||
lib/handshake.c | 3 ++-
|
||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/lib/handshake.c b/lib/handshake.c
|
||||
index cf025a84f6..21edc5ece9 100644
|
||||
--- a/lib/handshake.c
|
||||
+++ b/lib/handshake.c
|
||||
@@ -2861,7 +2861,8 @@ int gnutls_handshake(gnutls_session_t session)
|
||||
|
||||
#ifdef ENABLE_KTLS
|
||||
if (_gnutls_config_is_ktls_enabled()) {
|
||||
- if (session->internals.pull_func ||
|
||||
+ if ((session->internals.pull_func &&
|
||||
+ session->internals.pull_func != system_read) ||
|
||||
session->internals.push_func) {
|
||||
_gnutls_audit_log(session,
|
||||
"Not enabling KTLS with "
|
||||
--
|
||||
2.37.1
|
||||
|
|
@ -1,433 +0,0 @@
|
|||
diff --color -ruNp a/doc/Makefile.am b/doc/Makefile.am
|
||||
--- a/doc/Makefile.am 2022-11-15 14:14:10.632725399 +0100
|
||||
+++ b/doc/Makefile.am 2022-11-15 14:14:40.252300863 +0100
|
||||
@@ -575,6 +575,7 @@ ENUMS += enums/gnutls_certificate_verifi
|
||||
ENUMS += enums/gnutls_certificate_verify_flags
|
||||
ENUMS += enums/gnutls_channel_binding_t
|
||||
ENUMS += enums/gnutls_cipher_algorithm_t
|
||||
+ENUMS += enums/gnutls_cipher_flags_t
|
||||
ENUMS += enums/gnutls_close_request_t
|
||||
ENUMS += enums/gnutls_compression_method_t
|
||||
ENUMS += enums/gnutls_credentials_type_t
|
||||
@@ -882,12 +883,16 @@ FUNCS += functions/gnutls_cipher_decrypt
|
||||
FUNCS += functions/gnutls_cipher_decrypt.short
|
||||
FUNCS += functions/gnutls_cipher_decrypt2
|
||||
FUNCS += functions/gnutls_cipher_decrypt2.short
|
||||
+FUNCS += functions/gnutls_cipher_decrypt3
|
||||
+FUNCS += functions/gnutls_cipher_decrypt3.short
|
||||
FUNCS += functions/gnutls_cipher_deinit
|
||||
FUNCS += functions/gnutls_cipher_deinit.short
|
||||
FUNCS += functions/gnutls_cipher_encrypt
|
||||
FUNCS += functions/gnutls_cipher_encrypt.short
|
||||
FUNCS += functions/gnutls_cipher_encrypt2
|
||||
FUNCS += functions/gnutls_cipher_encrypt2.short
|
||||
+FUNCS += functions/gnutls_cipher_encrypt3
|
||||
+FUNCS += functions/gnutls_cipher_encrypt3.short
|
||||
FUNCS += functions/gnutls_cipher_get
|
||||
FUNCS += functions/gnutls_cipher_get.short
|
||||
FUNCS += functions/gnutls_cipher_get_block_size
|
||||
diff --color -ruNp a/doc/manpages/Makefile.am b/doc/manpages/Makefile.am
|
||||
--- a/doc/manpages/Makefile.am 2022-11-15 14:14:10.634725438 +0100
|
||||
+++ b/doc/manpages/Makefile.am 2022-11-15 14:14:40.254300902 +0100
|
||||
@@ -273,9 +273,11 @@ APIMANS += gnutls_check_version.3
|
||||
APIMANS += gnutls_cipher_add_auth.3
|
||||
APIMANS += gnutls_cipher_decrypt.3
|
||||
APIMANS += gnutls_cipher_decrypt2.3
|
||||
+APIMANS += gnutls_cipher_decrypt3.3
|
||||
APIMANS += gnutls_cipher_deinit.3
|
||||
APIMANS += gnutls_cipher_encrypt.3
|
||||
APIMANS += gnutls_cipher_encrypt2.3
|
||||
+APIMANS += gnutls_cipher_encrypt3.3
|
||||
APIMANS += gnutls_cipher_get.3
|
||||
APIMANS += gnutls_cipher_get_block_size.3
|
||||
APIMANS += gnutls_cipher_get_id.3
|
||||
diff --color -ruNp a/lib/crypto-api.c b/lib/crypto-api.c
|
||||
--- a/lib/crypto-api.c 2022-11-15 14:14:11.036733248 +0100
|
||||
+++ b/lib/crypto-api.c 2022-11-15 14:14:40.255300921 +0100
|
||||
@@ -413,6 +413,166 @@ gnutls_cipher_decrypt2(gnutls_cipher_hd_
|
||||
}
|
||||
|
||||
/**
|
||||
+ * gnutls_cipher_encrypt3:
|
||||
+ * @handle: is a #gnutls_cipher_hd_t type
|
||||
+ * @ptext: the data to encrypt
|
||||
+ * @ptext_len: the length of data to encrypt
|
||||
+ * @ctext: the encrypted data
|
||||
+ * @ctext_len: the length of encrypted data (initially must hold the maximum available size)
|
||||
+ * @flags: flags for padding
|
||||
+ *
|
||||
+ * This function will encrypt the given data using the algorithm
|
||||
+ * specified by the context. For block ciphers, @ptext_len is
|
||||
+ * typically a multiple of the block size. If not, the caller can
|
||||
+ * instruct the function to pad the last block according to @flags.
|
||||
+ * Currently, the only available padding scheme is
|
||||
+ * %GNUTLS_CIPHER_PADDING_PKCS7.
|
||||
+ *
|
||||
+ * If @ctext is not %NULL, it must hold enough space to store
|
||||
+ * resulting cipher text. To check the required size, this function
|
||||
+ * can be called with @ctext set to %NULL. Then @ctext_len will be
|
||||
+ * updated without performing actual encryption.
|
||||
+ *
|
||||
+ * Returns: Zero or a negative error code on error.
|
||||
+ *
|
||||
+ * Since: 3.7.7
|
||||
+ **/
|
||||
+int
|
||||
+gnutls_cipher_encrypt3(gnutls_cipher_hd_t handle,
|
||||
+ const void *ptext, size_t ptext_len,
|
||||
+ void *ctext, size_t *ctext_len,
|
||||
+ unsigned flags)
|
||||
+{
|
||||
+ api_cipher_hd_st *h = handle;
|
||||
+ const cipher_entry_st *e = h->ctx_enc.e;
|
||||
+ int block_size = _gnutls_cipher_get_block_size(e);
|
||||
+ int ret = 0;
|
||||
+
|
||||
+ if (unlikely(ctext_len == NULL)) {
|
||||
+ return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
|
||||
+ }
|
||||
+
|
||||
+ if (_gnutls_cipher_type(e) == CIPHER_BLOCK &&
|
||||
+ (flags & GNUTLS_CIPHER_PADDING_PKCS7)) {
|
||||
+ size_t n, r;
|
||||
+ uint8_t last_block[MAX_CIPHER_BLOCK_SIZE];
|
||||
+ const uint8_t *p = ptext;
|
||||
+ uint8_t *c = ctext;
|
||||
+
|
||||
+ if (!INT_ADD_OK(ptext_len, block_size, &n)) {
|
||||
+ return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
|
||||
+ }
|
||||
+
|
||||
+ n = (n / block_size) * block_size;
|
||||
+
|
||||
+ if (!ctext) {
|
||||
+ *ctext_len = n;
|
||||
+ return 0;
|
||||
+ }
|
||||
+
|
||||
+ if (*ctext_len < n) {
|
||||
+ return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
|
||||
+ }
|
||||
+
|
||||
+ /* Encrypt up to the last complete block */
|
||||
+ r = ptext_len % block_size;
|
||||
+
|
||||
+ ret = _gnutls_cipher_encrypt2(&h->ctx_enc,
|
||||
+ ptext, ptext_len - r,
|
||||
+ ctext, ptext_len - r);
|
||||
+ if (ret < 0) {
|
||||
+ goto error;
|
||||
+ }
|
||||
+
|
||||
+ /* Encrypt the last block with padding */
|
||||
+ gnutls_memset(last_block, block_size - r, sizeof(last_block));
|
||||
+ if (r > 0) {
|
||||
+ memcpy(last_block, &p[ptext_len - r], r);
|
||||
+ }
|
||||
+ ret = _gnutls_cipher_encrypt2(&h->ctx_enc,
|
||||
+ last_block, block_size,
|
||||
+ &c[ptext_len - r], block_size);
|
||||
+ if (ret < 0) {
|
||||
+ goto error;
|
||||
+ }
|
||||
+ *ctext_len = n;
|
||||
+ } else {
|
||||
+ if (!ctext) {
|
||||
+ *ctext_len = ptext_len;
|
||||
+ return 0;
|
||||
+ }
|
||||
+
|
||||
+ ret = _gnutls_cipher_encrypt2(&h->ctx_enc, ptext, ptext_len,
|
||||
+ ctext, *ctext_len);
|
||||
+ if (ret < 0) {
|
||||
+ goto error;
|
||||
+ }
|
||||
+ *ctext_len = ptext_len;
|
||||
+ }
|
||||
+
|
||||
+ error:
|
||||
+ if (ret < 0) {
|
||||
+ _gnutls_switch_fips_state(GNUTLS_FIPS140_OP_ERROR);
|
||||
+ } else {
|
||||
+ _gnutls_switch_fips_state(GNUTLS_FIPS140_OP_APPROVED);
|
||||
+ }
|
||||
+ return ret;
|
||||
+}
|
||||
+
|
||||
+/**
|
||||
+ * gnutls_cipher_decrypt3:
|
||||
+ * @handle: is a #gnutls_cipher_hd_t type
|
||||
+ * @ctext: the data to decrypt
|
||||
+ * @ctext_len: the length of data to decrypt
|
||||
+ * @ptext: the decrypted data
|
||||
+ * @ptext_len: the available length for decrypted data
|
||||
+ * @flags: flags for padding
|
||||
+ *
|
||||
+ * This function will decrypt the given data using the algorithm
|
||||
+ * specified by the context. If @flags is specified, padding for the
|
||||
+ * decrypted data will be removed accordingly and @ptext_len will be
|
||||
+ * updated.
|
||||
+ *
|
||||
+ * Returns: Zero or a negative error code on error.
|
||||
+ *
|
||||
+ * Since: 3.7.7
|
||||
+ **/
|
||||
+int
|
||||
+gnutls_cipher_decrypt3(gnutls_cipher_hd_t handle,
|
||||
+ const void *ctext, size_t ctext_len,
|
||||
+ void *ptext, size_t *ptext_len,
|
||||
+ unsigned flags)
|
||||
+{
|
||||
+ api_cipher_hd_st *h = handle;
|
||||
+ int ret;
|
||||
+
|
||||
+ ret = gnutls_cipher_decrypt2(handle,
|
||||
+ ctext, ctext_len,
|
||||
+ ptext, *ptext_len);
|
||||
+ if (ret < 0) {
|
||||
+ return ret;
|
||||
+ }
|
||||
+
|
||||
+ if (_gnutls_cipher_type(h->ctx_enc.e) == CIPHER_BLOCK &&
|
||||
+ (flags & GNUTLS_CIPHER_PADDING_PKCS7)) {
|
||||
+ uint8_t *p = ptext;
|
||||
+ uint8_t padding = p[*ptext_len - 1];
|
||||
+ if (!padding || padding > _gnutls_cipher_get_block_size(h->ctx_enc.e)) {
|
||||
+ return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);
|
||||
+ }
|
||||
+ /* Check that the prior bytes are all PADDING */
|
||||
+ for (size_t i = *ptext_len - padding; i < *ptext_len; i++) {
|
||||
+ if (padding != p[*ptext_len - 1]) {
|
||||
+ return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);
|
||||
+ }
|
||||
+ }
|
||||
+ *ptext_len -= padding;
|
||||
+ }
|
||||
+
|
||||
+ return 0;
|
||||
+}
|
||||
+
|
||||
+/**
|
||||
* gnutls_cipher_deinit:
|
||||
* @handle: is a #gnutls_cipher_hd_t type
|
||||
*
|
||||
diff --color -ruNp a/lib/includes/gnutls/crypto.h b/lib/includes/gnutls/crypto.h
|
||||
--- a/lib/includes/gnutls/crypto.h 2022-05-10 13:57:43.000000000 +0200
|
||||
+++ b/lib/includes/gnutls/crypto.h 2022-11-15 14:14:40.256300941 +0100
|
||||
@@ -49,6 +49,28 @@ int gnutls_cipher_encrypt2(gnutls_cipher
|
||||
const void *text, size_t textlen,
|
||||
void *ciphertext, size_t ciphertextlen);
|
||||
|
||||
+/**
|
||||
+ * gnutls_cipher_flags_t:
|
||||
+ * @GNUTLS_CIPHER_PADDING_PKCS7: Flag to indicate PKCS#7 padding
|
||||
+ *
|
||||
+ * Enumeration of flags to control block cipher padding, used by
|
||||
+ * gnutls_cipher_encrypt3() and gnutls_cipher_decrypt3().
|
||||
+ *
|
||||
+ * Since: 3.7.7
|
||||
+ */
|
||||
+typedef enum gnutls_cipher_flags_t {
|
||||
+ GNUTLS_CIPHER_PADDING_PKCS7 = 1
|
||||
+} gnutls_cipher_flags_t;
|
||||
+
|
||||
+int gnutls_cipher_encrypt3(gnutls_cipher_hd_t handle,
|
||||
+ const void *ptext, size_t ptext_len,
|
||||
+ void *ctext, size_t *ctext_len,
|
||||
+ unsigned flags);
|
||||
+int gnutls_cipher_decrypt3(gnutls_cipher_hd_t handle,
|
||||
+ const void *ctext, size_t ctext_len,
|
||||
+ void *ptext, size_t *ptext_len,
|
||||
+ unsigned flags);
|
||||
+
|
||||
void gnutls_cipher_set_iv(gnutls_cipher_hd_t handle, void *iv,
|
||||
size_t ivlen);
|
||||
|
||||
diff --color -ruNp a/lib/libgnutls.map b/lib/libgnutls.map
|
||||
--- a/lib/libgnutls.map 2022-11-15 14:14:11.142735308 +0100
|
||||
+++ b/lib/libgnutls.map 2022-11-15 14:14:40.256300941 +0100
|
||||
@@ -1403,6 +1403,8 @@ GNUTLS_3_7_7
|
||||
{
|
||||
global:
|
||||
gnutls_fips140_run_self_tests;
|
||||
+ gnutls_cipher_encrypt3;
|
||||
+ gnutls_cipher_decrypt3;
|
||||
local:
|
||||
*;
|
||||
} GNUTLS_3_7_5;
|
||||
diff --color -ruNp a/tests/cipher-padding.c b/tests/cipher-padding.c
|
||||
--- a/tests/cipher-padding.c 1970-01-01 01:00:00.000000000 +0100
|
||||
+++ b/tests/cipher-padding.c 2022-11-15 14:14:40.258300980 +0100
|
||||
@@ -0,0 +1,160 @@
|
||||
+/*
|
||||
+ * Copyright (C) 2022 Red Hat, Inc.
|
||||
+ *
|
||||
+ * Author: Daiki Ueno
|
||||
+ *
|
||||
+ * This file is part of GnuTLS.
|
||||
+ *
|
||||
+ * The GnuTLS is free software; you can redistribute it and/or
|
||||
+ * modify it under the terms of the GNU Lesser General Public License
|
||||
+ * as published by the Free Software Foundation; either version 2.1 of
|
||||
+ * the License, or (at your option) any later version.
|
||||
+ *
|
||||
+ * This library is distributed in the hope that it will be useful, but
|
||||
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
+ * Lesser General Public License for more details.
|
||||
+ *
|
||||
+ * You should have received a copy of the GNU Lesser General Public License
|
||||
+ * along with this program. If not, see <https://www.gnu.org/licenses/>
|
||||
+ *
|
||||
+ */
|
||||
+
|
||||
+#include <config.h>
|
||||
+
|
||||
+#include <gnutls/crypto.h>
|
||||
+#include <limits.h>
|
||||
+#include <stdint.h>
|
||||
+#include <stdio.h>
|
||||
+#include "utils.h"
|
||||
+
|
||||
+static void tls_log_func(int level, const char *str)
|
||||
+{
|
||||
+ fprintf(stderr, "<%d>| %s", level, str);
|
||||
+}
|
||||
+
|
||||
+#define CLAMP(x, b) (((x) + (b)) / (b)) * (b)
|
||||
+
|
||||
+static void
|
||||
+start(gnutls_cipher_algorithm_t algo, size_t plaintext_size, unsigned int flags)
|
||||
+{
|
||||
+ int ret;
|
||||
+ gnutls_cipher_hd_t ch;
|
||||
+ uint8_t key16[64];
|
||||
+ uint8_t iv16[32];
|
||||
+ uint8_t plaintext[128];
|
||||
+ uint8_t ciphertext[128];
|
||||
+ size_t block_size;
|
||||
+ size_t size;
|
||||
+ gnutls_datum_t key, iv;
|
||||
+
|
||||
+ success("%s %zu %u\n",
|
||||
+ gnutls_cipher_get_name(algo), plaintext_size, flags);
|
||||
+
|
||||
+ block_size = gnutls_cipher_get_block_size(algo);
|
||||
+
|
||||
+ key.data = key16;
|
||||
+ key.size = gnutls_cipher_get_key_size(algo);
|
||||
+ assert(key.size <= sizeof(key16));
|
||||
+
|
||||
+ iv.data = iv16;
|
||||
+ iv.size = gnutls_cipher_get_iv_size(algo);
|
||||
+ assert(iv.size <= sizeof(iv16));
|
||||
+
|
||||
+ memset(iv.data, 0xff, iv.size);
|
||||
+ memset(key.data, 0xfe, key.size);
|
||||
+ memset(plaintext, 0xfa, sizeof(plaintext));
|
||||
+
|
||||
+ ret = gnutls_cipher_init(&ch, algo, &key, &iv);
|
||||
+ if (ret < 0) {
|
||||
+ fail("gnutls_cipher_init failed\n");
|
||||
+ }
|
||||
+
|
||||
+ /* Check overflow if PKCS#7 is requested */
|
||||
+ if (flags & GNUTLS_CIPHER_PADDING_PKCS7) {
|
||||
+ ret = gnutls_cipher_encrypt3(ch,
|
||||
+ plaintext, SIZE_MAX,
|
||||
+ NULL, &size,
|
||||
+ flags);
|
||||
+ if (ret != GNUTLS_E_INVALID_REQUEST) {
|
||||
+ fail("gnutls_cipher_encrypt3 succeeded\n");
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ /* Get the ciphertext size */
|
||||
+ ret = gnutls_cipher_encrypt3(ch,
|
||||
+ plaintext, plaintext_size,
|
||||
+ NULL, &size,
|
||||
+ flags);
|
||||
+ if (ret < 0) {
|
||||
+ fail("gnutls_cipher_encrypt3 failed\n");
|
||||
+ }
|
||||
+
|
||||
+ if (flags & GNUTLS_CIPHER_PADDING_PKCS7) {
|
||||
+ if (size <= plaintext_size) {
|
||||
+ fail("no padding appended\n");
|
||||
+ }
|
||||
+ if (size != CLAMP(plaintext_size, block_size)) {
|
||||
+ fail("size does not match: %zu (expected %zu)\n",
|
||||
+ size, CLAMP(plaintext_size, block_size));
|
||||
+ }
|
||||
+ } else {
|
||||
+ if (size != plaintext_size) {
|
||||
+ fail("size does not match: %zu (expected %zu)\n",
|
||||
+ size, plaintext_size);
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ /* Encrypt with padding */
|
||||
+ ret = gnutls_cipher_encrypt3(ch,
|
||||
+ plaintext, plaintext_size,
|
||||
+ ciphertext, &size,
|
||||
+ flags);
|
||||
+ if (ret < 0) {
|
||||
+ fail("gnutls_cipher_encrypt3 failed\n");
|
||||
+ }
|
||||
+
|
||||
+ /* Decrypt with padding */
|
||||
+ ret = gnutls_cipher_decrypt3(ch,
|
||||
+ ciphertext, size,
|
||||
+ ciphertext, &size,
|
||||
+ flags);
|
||||
+ if (ret < 0) {
|
||||
+ fail("gnutls_cipher_encrypt3 failed\n");
|
||||
+ }
|
||||
+
|
||||
+ if (size != plaintext_size) {
|
||||
+ fail("size does not match: %zu (expected %zu)\n",
|
||||
+ size, plaintext_size);
|
||||
+ }
|
||||
+
|
||||
+ if (memcmp(ciphertext, plaintext, size) != 0) {
|
||||
+ fail("plaintext does not match\n");
|
||||
+ }
|
||||
+
|
||||
+ gnutls_cipher_deinit(ch);
|
||||
+}
|
||||
+
|
||||
+void doit(void) {
|
||||
+ int ret;
|
||||
+
|
||||
+ gnutls_global_set_log_function(tls_log_func);
|
||||
+ if (debug) {
|
||||
+ gnutls_global_set_log_level(4711);
|
||||
+ }
|
||||
+
|
||||
+ ret = global_init();
|
||||
+ if (ret < 0) {
|
||||
+ fail("Cannot initialize library\n");
|
||||
+ }
|
||||
+
|
||||
+ start(GNUTLS_CIPHER_AES_128_CBC, 0, GNUTLS_CIPHER_PADDING_PKCS7);
|
||||
+ start(GNUTLS_CIPHER_AES_128_CBC, 11, GNUTLS_CIPHER_PADDING_PKCS7);
|
||||
+ start(GNUTLS_CIPHER_AES_128_CBC, 77, GNUTLS_CIPHER_PADDING_PKCS7);
|
||||
+ start(GNUTLS_CIPHER_AES_128_CBC, 80, GNUTLS_CIPHER_PADDING_PKCS7);
|
||||
+
|
||||
+ start(GNUTLS_CIPHER_AES_128_CBC, 0, 0);
|
||||
+ start(GNUTLS_CIPHER_AES_128_CBC, 80, 0);
|
||||
+
|
||||
+ gnutls_global_deinit();
|
||||
+}
|
||||
diff --color -ruNp a/tests/Makefile.am b/tests/Makefile.am
|
||||
--- a/tests/Makefile.am 2022-11-15 14:14:11.144735347 +0100
|
||||
+++ b/tests/Makefile.am 2022-11-15 14:14:40.257300960 +0100
|
||||
@@ -233,7 +233,7 @@ ctests += mini-record-2 simple gnutls_hm
|
||||
tls13-without-timeout-func buffer status-request-revoked \
|
||||
set_x509_ocsp_multi_cli kdf-api keylog-func handshake-write \
|
||||
x509cert-dntypes id-on-xmppAddr tls13-compat-mode ciphersuite-name \
|
||||
- x509-upnconstraint xts-key-check pkcs7-verify-double-free \
|
||||
+ x509-upnconstraint cipher-padding xts-key-check pkcs7-verify-double-free \
|
||||
fips-rsa-sizes tls12-rehandshake-ticket
|
||||
|
||||
ctests += tls-channel-binding
|
|
@ -1,58 +0,0 @@
|
|||
From 51b721b69fd08ef1c4c4989f5e12b643e170ff56 Mon Sep 17 00:00:00 2001
|
||||
From: Pedro Monreal <pmgdeb@gmail.com>
|
||||
Date: Thu, 16 Feb 2023 17:02:38 +0100
|
||||
Subject: [PATCH] pk: extend pair-wise consistency to cover DH key generation
|
||||
|
||||
Perform SP800 56A (rev 3) 5.6.2.1.4 Owner Assurance of Pair-wise
|
||||
Consistency check, even if we only support ephemeral DH, as it is
|
||||
required by FIPS 140-3 IG 10.3.A.
|
||||
|
||||
Signed-off-by: Pedro Monreal <pmgdeb@gmail.com>
|
||||
Co-authored-by: Daiki Ueno <ueno@gnu.org>
|
||||
---
|
||||
lib/nettle/pk.c | 29 +++++++++++++++++++++++++++++
|
||||
1 file changed, 29 insertions(+)
|
||||
|
||||
diff --git a/lib/nettle/pk.c b/lib/nettle/pk.c
|
||||
index d30bca594f..bd9c1b4c74 100644
|
||||
--- a/lib/nettle/pk.c
|
||||
+++ b/lib/nettle/pk.c
|
||||
@@ -2642,6 +2642,35 @@ static int pct_test(gnutls_pk_algorithm_t algo,
|
||||
}
|
||||
break;
|
||||
case GNUTLS_PK_DH:
|
||||
+ {
|
||||
+ mpz_t y;
|
||||
+
|
||||
+ /* Perform SP800 56A (rev 3) 5.6.2.1.4 Owner Assurance
|
||||
+ * of Pair-wise Consistency check, even if we only
|
||||
+ * support ephemeral DH, as it is required by FIPS
|
||||
+ * 140-3 IG 10.3.A.
|
||||
+ *
|
||||
+ * Use the private key, x, along with the generator g
|
||||
+ * and prime modulus p included in the domain
|
||||
+ * parameters associated with the key pair to compute
|
||||
+ * g^x mod p. Compare the result to the public key, y.
|
||||
+ */
|
||||
+ mpz_init(y);
|
||||
+ mpz_powm(y,
|
||||
+ TOMPZ(params->params[DSA_G]),
|
||||
+ TOMPZ(params->params[DSA_X]),
|
||||
+ TOMPZ(params->params[DSA_P]));
|
||||
+ if (unlikely
|
||||
+ (mpz_cmp(y, TOMPZ(params->params[DSA_Y])) != 0)) {
|
||||
+ ret =
|
||||
+ gnutls_assert_val
|
||||
+ (GNUTLS_E_PK_GENERATION_ERROR);
|
||||
+ mpz_clear(y);
|
||||
+ goto cleanup;
|
||||
+ }
|
||||
+ mpz_clear(y);
|
||||
+ break;
|
||||
+ }
|
||||
case GNUTLS_PK_ECDH_X25519:
|
||||
case GNUTLS_PK_ECDH_X448:
|
||||
ret = 0;
|
||||
--
|
||||
2.39.2
|
||||
|
|
@ -1,54 +0,0 @@
|
|||
diff --color -ruNp a/lib/fips.c b/lib/fips.c
|
||||
--- a/lib/fips.c 2022-11-15 16:10:56.183185457 +0100
|
||||
+++ b/lib/fips.c 2022-11-15 16:10:23.488530716 +0100
|
||||
@@ -360,11 +360,6 @@ static int check_lib_hmac(struct hmac_en
|
||||
return gnutls_assert_val(ret);
|
||||
}
|
||||
|
||||
- if (strncmp(entry->path, path, GNUTLS_PATH_MAX)) {
|
||||
- _gnutls_debug_log("Library path for %s does not match with HMAC file\n", lib);
|
||||
- return gnutls_assert_val(GNUTLS_E_PARSING_ERROR);
|
||||
- }
|
||||
-
|
||||
_gnutls_debug_log("Loading: %s\n", path);
|
||||
ret = gnutls_load_file(path, &data);
|
||||
if (ret < 0) {
|
||||
diff --color -ruNp a/lib/fipshmac.c b/lib/fipshmac.c
|
||||
--- a/lib/fipshmac.c 2022-11-15 16:10:56.183185457 +0100
|
||||
+++ b/lib/fipshmac.c 2022-11-15 16:10:23.489530737 +0100
|
||||
@@ -102,20 +102,30 @@ static int get_hmac(const char *path, ch
|
||||
static int print_lib_path(const char *path)
|
||||
{
|
||||
int ret;
|
||||
+ char *real_path = NULL;
|
||||
char hmac[HMAC_STR_SIZE];
|
||||
|
||||
- ret = get_hmac(path, hmac, sizeof(hmac));
|
||||
+ real_path = canonicalize_file_name(path);
|
||||
+ if (real_path == NULL) {
|
||||
+ fprintf(stderr, "Could not get realpath from %s\n", path);
|
||||
+ ret = GNUTLS_E_FILE_ERROR;
|
||||
+ goto cleanup;
|
||||
+ }
|
||||
+
|
||||
+ ret = get_hmac(real_path, hmac, sizeof(hmac));
|
||||
if (ret < 0) {
|
||||
fprintf(stderr, "Could not calculate HMAC for %s: %s\n",
|
||||
- last_component(path), gnutls_strerror(ret));
|
||||
- return ret;
|
||||
+ last_component(real_path), gnutls_strerror(ret));
|
||||
+ goto cleanup;
|
||||
}
|
||||
|
||||
printf("[%s]\n", last_component(path));
|
||||
- printf("path = %s\n", path);
|
||||
+ printf("path = %s\n", real_path);
|
||||
printf("hmac = %s\n", hmac);
|
||||
|
||||
- return 0;
|
||||
+cleanup:
|
||||
+ free(real_path);
|
||||
+ return ret;
|
||||
}
|
||||
|
||||
static int print_lib_dl(const char *lib, const char *sym)
|
|
@ -1,534 +0,0 @@
|
|||
diff --color -ruNp a/configure.ac b/configure.ac
|
||||
--- a/configure.ac 2022-05-27 09:17:26.000000000 +0200
|
||||
+++ b/configure.ac 2022-12-15 11:00:18.830698584 +0100
|
||||
@@ -619,6 +619,8 @@ if [ test "$enable_fips" = "yes" ];then
|
||||
if test "x$fips_module_version" != xnone; then
|
||||
AC_DEFINE_UNQUOTED([FIPS_MODULE_VERSION], ["$fips_module_version"], [The FIPS140 module version])
|
||||
fi
|
||||
+
|
||||
+ AC_CHECK_FUNCS(dl_iterate_phdr)
|
||||
else
|
||||
enable_fips=no
|
||||
AC_MSG_WARN([[
|
||||
diff --color -ruNp a/lib/fips.c b/lib/fips.c
|
||||
--- a/lib/fips.c 2022-12-15 10:59:57.460279029 +0100
|
||||
+++ b/lib/fips.c 2022-12-15 11:00:18.831698604 +0100
|
||||
@@ -23,9 +23,11 @@
|
||||
#include <gnutls/gnutls.h>
|
||||
#include <gnutls/crypto.h>
|
||||
#include <unistd.h>
|
||||
+#include "dirname.h"
|
||||
#include "errors.h"
|
||||
#include "file.h"
|
||||
#include "inih/ini.h"
|
||||
+#include "str.h"
|
||||
#include <fips.h>
|
||||
#include <gnutls/self-test.h>
|
||||
#include <stdio.h>
|
||||
@@ -34,6 +36,10 @@
|
||||
|
||||
#include "gthreads.h"
|
||||
|
||||
+#ifdef HAVE_DL_ITERATE_PHDR
|
||||
+#include <link.h>
|
||||
+#endif
|
||||
+
|
||||
unsigned int _gnutls_lib_state = LIB_STATE_POWERON;
|
||||
|
||||
struct gnutls_fips140_context_st {
|
||||
@@ -153,7 +159,6 @@ void _gnutls_fips_mode_reset_zombie(void
|
||||
|
||||
#define HMAC_SIZE 32
|
||||
#define HMAC_ALGO GNUTLS_MAC_SHA256
|
||||
-#define HMAC_FILE_NAME ".gnutls.hmac"
|
||||
#define HMAC_FORMAT_VERSION 1
|
||||
|
||||
struct hmac_entry
|
||||
@@ -162,51 +167,32 @@ struct hmac_entry
|
||||
uint8_t hmac[HMAC_SIZE];
|
||||
};
|
||||
|
||||
-typedef struct
|
||||
+struct hmac_file
|
||||
{
|
||||
int version;
|
||||
struct hmac_entry gnutls;
|
||||
struct hmac_entry nettle;
|
||||
struct hmac_entry hogweed;
|
||||
struct hmac_entry gmp;
|
||||
-} hmac_file;
|
||||
+};
|
||||
|
||||
-static int get_library_path(const char* lib, const char* symbol, char* path, size_t path_size)
|
||||
+struct lib_paths
|
||||
{
|
||||
- int ret;
|
||||
- void *dl, *sym;
|
||||
- Dl_info info;
|
||||
-
|
||||
- dl = dlopen(lib, RTLD_LAZY);
|
||||
- if (dl == NULL)
|
||||
- return gnutls_assert_val(GNUTLS_E_FILE_ERROR);
|
||||
-
|
||||
- sym = dlsym(dl, symbol);
|
||||
- if (sym == NULL) {
|
||||
- ret = gnutls_assert_val(GNUTLS_E_FILE_ERROR);
|
||||
- goto cleanup;
|
||||
- }
|
||||
-
|
||||
- ret = dladdr(sym, &info);
|
||||
- if (ret == 0) {
|
||||
- ret = gnutls_assert_val(GNUTLS_E_FILE_ERROR);
|
||||
- goto cleanup;
|
||||
- }
|
||||
-
|
||||
- ret = snprintf(path, path_size, "%s", info.dli_fname);
|
||||
- if ((size_t)ret >= path_size) {
|
||||
- ret = gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
|
||||
- goto cleanup;
|
||||
- }
|
||||
-
|
||||
- ret = 0;
|
||||
-cleanup:
|
||||
- dlclose(dl);
|
||||
- return ret;
|
||||
-}
|
||||
+ char gnutls[GNUTLS_PATH_MAX];
|
||||
+ char nettle[GNUTLS_PATH_MAX];
|
||||
+ char hogweed[GNUTLS_PATH_MAX];
|
||||
+ char gmp[GNUTLS_PATH_MAX];
|
||||
+};
|
||||
|
||||
-/* Parses hmac data and copies hex value into dest.
|
||||
+/*
|
||||
+ * get_hmac:
|
||||
+ * @dest: buffer for the hex value
|
||||
+ * @value: hmac value
|
||||
+ *
|
||||
+ * Parses hmac data and copies hex value into dest.
|
||||
* dest must point to at least HMAC_SIZE amount of memory
|
||||
+ *
|
||||
+ * Returns: 0 on success, a negative error code otherwise
|
||||
*/
|
||||
static int get_hmac(uint8_t *dest, const char *value)
|
||||
{
|
||||
@@ -245,7 +231,7 @@ lib_handler(struct hmac_entry *entry,
|
||||
|
||||
static int handler(void *user, const char *section, const char *name, const char *value)
|
||||
{
|
||||
- hmac_file *p = (hmac_file *)user;
|
||||
+ struct hmac_file *p = (struct hmac_file *)user;
|
||||
|
||||
if (!strcmp(section, "global")) {
|
||||
if (!strcmp(name, "format-version")) {
|
||||
@@ -267,24 +253,29 @@ static int handler(void *user, const cha
|
||||
return 1;
|
||||
}
|
||||
|
||||
-static int get_hmac_path(char *mac_file, size_t mac_file_size)
|
||||
+/*
|
||||
+ * get_hmac_path:
|
||||
+ * @mac_file: buffer where the hmac file path will be written to
|
||||
+ * @mac_file_size: size of the mac_file buffer
|
||||
+ * @gnutls_path: path to the gnutls library, used to deduce hmac file path
|
||||
+ *
|
||||
+ * Deduces hmac file path from the gnutls library path.
|
||||
+ *
|
||||
+ * Returns: 0 on success, a negative error code otherwise
|
||||
+ */
|
||||
+static int get_hmac_path(char *mac_file, size_t mac_file_size, const char *gnutls_path)
|
||||
{
|
||||
int ret;
|
||||
char *p;
|
||||
- char file[GNUTLS_PATH_MAX];
|
||||
|
||||
- ret = get_library_path(GNUTLS_LIBRARY_NAME, "gnutls_global_init",
|
||||
- file, sizeof(file));
|
||||
- if (ret < 0)
|
||||
- return ret;
|
||||
-
|
||||
- p = strrchr(file, '/');
|
||||
+ p = strrchr(gnutls_path, '/');
|
||||
|
||||
if (p == NULL)
|
||||
- ret = snprintf(mac_file, mac_file_size, HMAC_FILE_NAME);
|
||||
+ ret = snprintf(mac_file, mac_file_size, ".%s.hmac", gnutls_path);
|
||||
else
|
||||
- ret = snprintf(mac_file, mac_file_size,
|
||||
- "%.*s/"HMAC_FILE_NAME, (int)(p - file), file);
|
||||
+ ret = snprintf(mac_file, mac_file_size, "%.*s/.%s.hmac",
|
||||
+ (int)(p - gnutls_path), gnutls_path, p + 1);
|
||||
+
|
||||
if ((size_t)ret >= mac_file_size)
|
||||
return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
|
||||
|
||||
@@ -293,10 +284,11 @@ static int get_hmac_path(char *mac_file,
|
||||
return GNUTLS_E_SUCCESS;
|
||||
|
||||
if (p == NULL)
|
||||
- ret = snprintf(mac_file, mac_file_size, "fipscheck/"HMAC_FILE_NAME);
|
||||
+ ret = snprintf(mac_file, mac_file_size, "fipscheck/.%s.hmac", gnutls_path);
|
||||
else
|
||||
- ret = snprintf(mac_file, mac_file_size,
|
||||
- "%.*s/fipscheck/"HMAC_FILE_NAME, (int)(p - file), file);
|
||||
+ ret = snprintf(mac_file, mac_file_size, "%.*s/fipscheck/.%s.hmac",
|
||||
+ (int)(p - gnutls_path), gnutls_path, p + 1);
|
||||
+
|
||||
if ((size_t)ret >= mac_file_size)
|
||||
return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
|
||||
|
||||
@@ -307,51 +299,52 @@ static int get_hmac_path(char *mac_file,
|
||||
return GNUTLS_E_FILE_ERROR;
|
||||
}
|
||||
|
||||
-static int load_hmac_file(hmac_file *p)
|
||||
+/*
|
||||
+ * load_hmac_file:
|
||||
+ * @hmac_file: hmac file structure
|
||||
+ * @hmac_path: path to the hmac file
|
||||
+ *
|
||||
+ * Loads the hmac file into the hmac file structure.
|
||||
+ *
|
||||
+ * Returns: 0 on success, a negative error code otherwise
|
||||
+ */
|
||||
+static int load_hmac_file(struct hmac_file *hmac_file, const char *hmac_path)
|
||||
{
|
||||
int ret;
|
||||
FILE *stream;
|
||||
- char hmac_path[GNUTLS_PATH_MAX];
|
||||
-
|
||||
- ret = get_hmac_path(hmac_path, sizeof(hmac_path));
|
||||
- if (ret < 0)
|
||||
- return gnutls_assert_val(ret);
|
||||
|
||||
stream = fopen(hmac_path, "r");
|
||||
if (stream == NULL)
|
||||
return gnutls_assert_val(GNUTLS_E_FILE_ERROR);
|
||||
|
||||
- gnutls_memset(p, 0, sizeof(*p));
|
||||
- ret = ini_parse_file(stream, handler, p);
|
||||
+ gnutls_memset(hmac_file, 0, sizeof(*hmac_file));
|
||||
+ ret = ini_parse_file(stream, handler, hmac_file);
|
||||
fclose(stream);
|
||||
if (ret < 0)
|
||||
return gnutls_assert_val(GNUTLS_E_PARSING_ERROR);
|
||||
|
||||
- if (p->version != HMAC_FORMAT_VERSION)
|
||||
+ if (hmac_file->version != HMAC_FORMAT_VERSION)
|
||||
return gnutls_assert_val(GNUTLS_E_PARSING_ERROR);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
-/* Run an HMAC using the key above on the library binary data.
|
||||
- * Returns 0 on success and negative value on error.
|
||||
+/*
|
||||
+ * check_lib_hmac:
|
||||
+ * @entry: hmac file entry
|
||||
+ * @path: path to the library which hmac should be compared
|
||||
+ *
|
||||
+ * Verify that HMAC from hmac file entry matches HMAC of given library.
|
||||
+ *
|
||||
+ * Returns: 0 on successful HMAC verification, a negative error code otherwise
|
||||
*/
|
||||
-static int check_lib_hmac(struct hmac_entry *entry,
|
||||
- const char *lib, const char *sym)
|
||||
+static int check_lib_hmac(struct hmac_entry *entry, const char *path)
|
||||
{
|
||||
int ret;
|
||||
unsigned prev;
|
||||
- char path[GNUTLS_PATH_MAX];
|
||||
uint8_t hmac[HMAC_SIZE];
|
||||
gnutls_datum_t data;
|
||||
|
||||
- ret = get_library_path(lib, sym, path, sizeof(path));
|
||||
- if (ret < 0) {
|
||||
- _gnutls_debug_log("Could not get lib path for %s: %s\n",
|
||||
- lib, gnutls_strerror(ret));
|
||||
- return gnutls_assert_val(ret);
|
||||
- }
|
||||
-
|
||||
_gnutls_debug_log("Loading: %s\n", path);
|
||||
ret = gnutls_load_file(path, &data);
|
||||
if (ret < 0) {
|
||||
@@ -382,28 +375,99 @@ static int check_lib_hmac(struct hmac_en
|
||||
return 0;
|
||||
}
|
||||
|
||||
+#ifdef HAVE_DL_ITERATE_PHDR
|
||||
+
|
||||
+static int callback(struct dl_phdr_info *info, size_t size, void *data)
|
||||
+{
|
||||
+ const char *path = info->dlpi_name;
|
||||
+ const char *soname = last_component(path);
|
||||
+ struct lib_paths *paths = (struct lib_paths *)data;
|
||||
+
|
||||
+ if (!strcmp(soname, GNUTLS_LIBRARY_SONAME))
|
||||
+ _gnutls_str_cpy(paths->gnutls, GNUTLS_PATH_MAX, path);
|
||||
+ else if (!strcmp(soname, NETTLE_LIBRARY_SONAME))
|
||||
+ _gnutls_str_cpy(paths->nettle, GNUTLS_PATH_MAX, path);
|
||||
+ else if (!strcmp(soname, HOGWEED_LIBRARY_SONAME))
|
||||
+ _gnutls_str_cpy(paths->hogweed, GNUTLS_PATH_MAX, path);
|
||||
+ else if (!strcmp(soname, GMP_LIBRARY_SONAME))
|
||||
+ _gnutls_str_cpy(paths->gmp, GNUTLS_PATH_MAX, path);
|
||||
+ return 0;
|
||||
+}
|
||||
+
|
||||
+static int load_lib_paths(struct lib_paths *paths)
|
||||
+{
|
||||
+ memset(paths, 0, sizeof(*paths));
|
||||
+ dl_iterate_phdr(callback, paths);
|
||||
+
|
||||
+ if (paths->gnutls[0] == '\0') {
|
||||
+ _gnutls_debug_log("Gnutls library path was not found\n");
|
||||
+ return gnutls_assert_val(GNUTLS_E_FILE_ERROR);
|
||||
+ }
|
||||
+ if (paths->nettle[0] == '\0') {
|
||||
+ _gnutls_debug_log("Nettle library path was not found\n");
|
||||
+ return gnutls_assert_val(GNUTLS_E_FILE_ERROR);
|
||||
+ }
|
||||
+ if (paths->hogweed[0] == '\0') {
|
||||
+ _gnutls_debug_log("Hogweed library path was not found\n");
|
||||
+ return gnutls_assert_val(GNUTLS_E_FILE_ERROR);
|
||||
+ }
|
||||
+ if (paths->gmp[0] == '\0') {
|
||||
+ _gnutls_debug_log("Gmp library path was not found\n");
|
||||
+ return gnutls_assert_val(GNUTLS_E_FILE_ERROR);
|
||||
+ }
|
||||
+
|
||||
+ return GNUTLS_E_SUCCESS;
|
||||
+}
|
||||
+
|
||||
+#else
|
||||
+
|
||||
+static int load_lib_paths(struct lib_paths *paths)
|
||||
+{
|
||||
+ (void)paths;
|
||||
+ _gnutls_debug_log("Function dl_iterate_phdr is missing\n");
|
||||
+ return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);
|
||||
+}
|
||||
+
|
||||
+#endif /* HAVE_DL_ITERATE_PHDR */
|
||||
+
|
||||
static int check_binary_integrity(void)
|
||||
{
|
||||
int ret;
|
||||
- hmac_file file;
|
||||
+ struct lib_paths paths;
|
||||
+ struct hmac_file hmac;
|
||||
+ char hmac_path[GNUTLS_PATH_MAX];
|
||||
+
|
||||
+ ret = load_lib_paths(&paths);
|
||||
+ if (ret < 0) {
|
||||
+ _gnutls_debug_log("Could not load library paths: %s\n",
|
||||
+ gnutls_strerror(ret));
|
||||
+ return ret;
|
||||
+ }
|
||||
+
|
||||
+ ret = get_hmac_path(hmac_path, sizeof(hmac_path), paths.gnutls);
|
||||
+ if (ret < 0) {
|
||||
+ _gnutls_debug_log("Could not get hmac file path: %s\n",
|
||||
+ gnutls_strerror(ret));
|
||||
+ return ret;
|
||||
+ }
|
||||
|
||||
- ret = load_hmac_file(&file);
|
||||
+ ret = load_hmac_file(&hmac, hmac_path);
|
||||
if (ret < 0) {
|
||||
_gnutls_debug_log("Could not load hmac file: %s\n",
|
||||
gnutls_strerror(ret));
|
||||
return ret;
|
||||
}
|
||||
|
||||
- ret = check_lib_hmac(&file.gnutls, GNUTLS_LIBRARY_NAME, "gnutls_global_init");
|
||||
+ ret = check_lib_hmac(&hmac.gnutls, paths.gnutls);
|
||||
if (ret < 0)
|
||||
return ret;
|
||||
- ret = check_lib_hmac(&file.nettle, NETTLE_LIBRARY_NAME, "nettle_aes_set_encrypt_key");
|
||||
+ ret = check_lib_hmac(&hmac.nettle, paths.nettle);
|
||||
if (ret < 0)
|
||||
return ret;
|
||||
- ret = check_lib_hmac(&file.hogweed, HOGWEED_LIBRARY_NAME, "nettle_mpz_sizeinbase_256_u");
|
||||
+ ret = check_lib_hmac(&hmac.hogweed, paths.hogweed);
|
||||
if (ret < 0)
|
||||
return ret;
|
||||
- ret = check_lib_hmac(&file.gmp, GMP_LIBRARY_NAME, "__gmpz_init");
|
||||
+ ret = check_lib_hmac(&hmac.gmp, paths.gmp);
|
||||
if (ret < 0)
|
||||
return ret;
|
||||
|
||||
diff --color -ruNp a/lib/fipshmac.c b/lib/fipshmac.c
|
||||
--- a/lib/fipshmac.c 2022-12-15 10:59:57.461279049 +0100
|
||||
+++ b/lib/fipshmac.c 2022-12-15 11:00:18.832698623 +0100
|
||||
@@ -22,12 +22,14 @@
|
||||
|
||||
#include "config.h"
|
||||
|
||||
-#include <gnutls/gnutls.h>
|
||||
-#include <gnutls/crypto.h>
|
||||
-#include <dlfcn.h>
|
||||
-#include <stdint.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
+
|
||||
+#ifdef HAVE_DL_ITERATE_PHDR
|
||||
+
|
||||
+#include <gnutls/gnutls.h>
|
||||
+#include <gnutls/crypto.h>
|
||||
+#include <link.h>
|
||||
#include "dirname.h"
|
||||
#include "errors.h"
|
||||
|
||||
@@ -36,40 +38,6 @@
|
||||
#define HMAC_ALGO GNUTLS_MAC_SHA256
|
||||
#define HMAC_STR_SIZE (2 * HMAC_SIZE + 1)
|
||||
|
||||
-static int get_path(const char *lib, const char *symbol, char *path, size_t path_size)
|
||||
-{
|
||||
- int ret;
|
||||
- void *dl, *sym;
|
||||
- Dl_info info;
|
||||
-
|
||||
- dl = dlopen(lib, RTLD_LAZY);
|
||||
- if (dl == NULL)
|
||||
- return gnutls_assert_val(GNUTLS_E_FILE_ERROR);
|
||||
-
|
||||
- sym = dlsym(dl, symbol);
|
||||
- if (sym == NULL) {
|
||||
- ret = gnutls_assert_val(GNUTLS_E_FILE_ERROR);
|
||||
- goto cleanup;
|
||||
- }
|
||||
-
|
||||
- ret = dladdr(sym, &info);
|
||||
- if (ret == 0) {
|
||||
- ret = gnutls_assert_val(GNUTLS_E_FILE_ERROR);
|
||||
- goto cleanup;
|
||||
- }
|
||||
-
|
||||
- ret = snprintf(path, path_size, "%s", info.dli_fname);
|
||||
- if ((size_t)ret >= path_size) {
|
||||
- ret = gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
|
||||
- goto cleanup;
|
||||
- }
|
||||
-
|
||||
- ret = 0;
|
||||
-cleanup:
|
||||
- dlclose(dl);
|
||||
- return ret;
|
||||
-}
|
||||
-
|
||||
static int get_hmac(const char *path, char *hmac, size_t hmac_size)
|
||||
{
|
||||
int ret;
|
||||
@@ -99,7 +67,7 @@ static int get_hmac(const char *path, ch
|
||||
return 0;
|
||||
}
|
||||
|
||||
-static int print_lib_path(const char *path)
|
||||
+static int print_lib(const char *path, const char *soname)
|
||||
{
|
||||
int ret;
|
||||
char *real_path = NULL;
|
||||
@@ -119,7 +87,7 @@ static int print_lib_path(const char *pa
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
- printf("[%s]\n", last_component(path));
|
||||
+ printf("[%s]\n", soname);
|
||||
printf("path = %s\n", real_path);
|
||||
printf("hmac = %s\n", hmac);
|
||||
|
||||
@@ -128,25 +96,24 @@ cleanup:
|
||||
return ret;
|
||||
}
|
||||
|
||||
-static int print_lib_dl(const char *lib, const char *sym)
|
||||
+static int callback(struct dl_phdr_info *info, size_t size, void *data)
|
||||
{
|
||||
- int ret;
|
||||
- char path[GNUTLS_PATH_MAX];
|
||||
-
|
||||
- ret = get_path(lib, sym, path, sizeof(path));
|
||||
- if (ret < 0) {
|
||||
- fprintf(stderr, "Could not get lib path for %s: %s\n",
|
||||
- lib, gnutls_strerror(ret));
|
||||
- return ret;
|
||||
- }
|
||||
+ const char *path = info->dlpi_name;
|
||||
+ const char *soname = last_component(path);
|
||||
|
||||
- return print_lib_path(path);
|
||||
+ if (!strcmp(soname, GNUTLS_LIBRARY_SONAME))
|
||||
+ return print_lib(data ? data : path, soname);
|
||||
+ if (!strcmp(soname, NETTLE_LIBRARY_SONAME))
|
||||
+ return print_lib(path, soname);
|
||||
+ if (!strcmp(soname, HOGWEED_LIBRARY_SONAME))
|
||||
+ return print_lib(path, soname);
|
||||
+ if (!strcmp(soname, GMP_LIBRARY_SONAME))
|
||||
+ return print_lib(path, soname);
|
||||
+ return 0;
|
||||
}
|
||||
|
||||
int main(int argc, char **argv)
|
||||
{
|
||||
- int ret;
|
||||
-
|
||||
if (argc != 1 && argc != 2) {
|
||||
fprintf(stderr, "Usage: %s [gnutls_so_path]\n", last_component(argv[0]));
|
||||
return EXIT_FAILURE;
|
||||
@@ -155,24 +122,15 @@ int main(int argc, char **argv)
|
||||
printf("[global]\n");
|
||||
printf("format-version = %d\n", FORMAT_VERSION);
|
||||
|
||||
- if (argc == 2)
|
||||
- ret = print_lib_path(argv[1]);
|
||||
- else
|
||||
- ret = print_lib_dl(GNUTLS_LIBRARY_SONAME, "gnutls_global_init");
|
||||
- if (ret < 0)
|
||||
- return EXIT_FAILURE;
|
||||
+ return dl_iterate_phdr(callback, argc == 2 ? argv[1] : NULL);
|
||||
+}
|
||||
|
||||
- ret = print_lib_dl(NETTLE_LIBRARY_SONAME, "nettle_aes_set_encrypt_key");
|
||||
- if (ret < 0)
|
||||
- return EXIT_FAILURE;
|
||||
-
|
||||
- ret = print_lib_dl(HOGWEED_LIBRARY_SONAME, "nettle_mpz_sizeinbase_256_u");
|
||||
- if (ret < 0)
|
||||
- return EXIT_FAILURE;
|
||||
-
|
||||
- ret = print_lib_dl(GMP_LIBRARY_SONAME, "__gmpz_init");
|
||||
- if (ret < 0)
|
||||
- return EXIT_FAILURE;
|
||||
+#else
|
||||
|
||||
- return EXIT_SUCCESS;
|
||||
+int main(void)
|
||||
+{
|
||||
+ fprintf(stderr, "Function dl_iterate_phdr is missing\n");
|
||||
+ return EXIT_FAILURE;
|
||||
}
|
||||
+
|
||||
+#endif /* HAVE_DL_ITERATE_PHDR */
|
||||
diff --color -ruNp a/lib/Makefile.am b/lib/Makefile.am
|
||||
--- a/lib/Makefile.am 2022-05-18 16:46:00.000000000 +0200
|
||||
+++ b/lib/Makefile.am 2022-12-15 11:00:18.789697779 +0100
|
||||
@@ -202,14 +202,14 @@ noinst_PROGRAMS = fipshmac
|
||||
fipshmac_SOURCES = fipshmac.c
|
||||
fipshmac_LDADD = libgnutls.la ../gl/libgnu.la
|
||||
|
||||
-hmac_files = .libs/.gnutls.hmac
|
||||
+hmac_file = .libs/.$(gnutls_so).hmac
|
||||
|
||||
-all-local: $(hmac_files)
|
||||
+all-local: $(hmac_file)
|
||||
|
||||
-.libs/.gnutls.hmac: libgnutls.la fipshmac
|
||||
+$(hmac_file): libgnutls.la fipshmac
|
||||
$(AM_V_GEN) $(builddir)/fipshmac > $@-t && mv $@-t $@
|
||||
|
||||
-CLEANFILES = $(hmac_files)
|
||||
+CLEANFILES = $(hmac_file)
|
||||
endif
|
||||
|
||||
if NEED_LTLIBDL
|
|
@ -1,220 +0,0 @@
|
|||
diff --color -ruNp a/lib/accelerated/x86/aes-xts-x86-aesni.c b/lib/accelerated/x86/aes-xts-x86-aesni.c
|
||||
--- a/lib/accelerated/x86/aes-xts-x86-aesni.c 2022-03-02 12:38:09.000000000 +0100
|
||||
+++ b/lib/accelerated/x86/aes-xts-x86-aesni.c 2022-11-07 14:12:38.476982750 +0100
|
||||
@@ -73,7 +73,6 @@ x86_aes_xts_cipher_setkey(void *_ctx, co
|
||||
/* Check key block according to FIPS-140-2 IG A.9 */
|
||||
if (_gnutls_fips_mode_enabled()){
|
||||
if (gnutls_memcmp(key, key + (keysize / 2), keysize / 2) == 0) {
|
||||
- _gnutls_switch_lib_state(LIB_STATE_ERROR);
|
||||
return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
|
||||
}
|
||||
}
|
||||
diff --color -ruNp a/lib/nettle/cipher.c b/lib/nettle/cipher.c
|
||||
--- a/lib/nettle/cipher.c 2022-11-07 14:10:13.672085930 +0100
|
||||
+++ b/lib/nettle/cipher.c 2022-11-07 14:12:38.477982770 +0100
|
||||
@@ -448,12 +448,14 @@ _gcm_decrypt(struct nettle_cipher_ctx *c
|
||||
length, dst, src);
|
||||
}
|
||||
|
||||
-static void _des_set_key(struct des_ctx *ctx, const uint8_t *key)
|
||||
+static void
|
||||
+_des_set_key(struct des_ctx *ctx, const uint8_t *key)
|
||||
{
|
||||
des_set_key(ctx, key);
|
||||
}
|
||||
|
||||
-static void _des3_set_key(struct des3_ctx *ctx, const uint8_t *key)
|
||||
+static void
|
||||
+_des3_set_key(struct des3_ctx *ctx, const uint8_t *key)
|
||||
{
|
||||
des3_set_key(ctx, key);
|
||||
}
|
||||
@@ -477,50 +479,6 @@ _cfb8_decrypt(struct nettle_cipher_ctx *
|
||||
}
|
||||
|
||||
static void
|
||||
-_xts_aes128_set_encrypt_key(struct xts_aes128_key *xts_key,
|
||||
- const uint8_t *key)
|
||||
-{
|
||||
- if (_gnutls_fips_mode_enabled() &&
|
||||
- gnutls_memcmp(key, key + AES128_KEY_SIZE, AES128_KEY_SIZE) == 0)
|
||||
- _gnutls_switch_lib_state(LIB_STATE_ERROR);
|
||||
-
|
||||
- xts_aes128_set_encrypt_key(xts_key, key);
|
||||
-}
|
||||
-
|
||||
-static void
|
||||
-_xts_aes128_set_decrypt_key(struct xts_aes128_key *xts_key,
|
||||
- const uint8_t *key)
|
||||
-{
|
||||
- if (_gnutls_fips_mode_enabled() &&
|
||||
- gnutls_memcmp(key, key + AES128_KEY_SIZE, AES128_KEY_SIZE) == 0)
|
||||
- _gnutls_switch_lib_state(LIB_STATE_ERROR);
|
||||
-
|
||||
- xts_aes128_set_decrypt_key(xts_key, key);
|
||||
-}
|
||||
-
|
||||
-static void
|
||||
-_xts_aes256_set_encrypt_key(struct xts_aes256_key *xts_key,
|
||||
- const uint8_t *key)
|
||||
-{
|
||||
- if (_gnutls_fips_mode_enabled() &&
|
||||
- gnutls_memcmp(key, key + AES256_KEY_SIZE, AES256_KEY_SIZE) == 0)
|
||||
- _gnutls_switch_lib_state(LIB_STATE_ERROR);
|
||||
-
|
||||
- xts_aes256_set_encrypt_key(xts_key, key);
|
||||
-}
|
||||
-
|
||||
-static void
|
||||
-_xts_aes256_set_decrypt_key(struct xts_aes256_key *xts_key,
|
||||
- const uint8_t *key)
|
||||
-{
|
||||
- if (_gnutls_fips_mode_enabled() &&
|
||||
- gnutls_memcmp(key, key + AES256_KEY_SIZE, AES256_KEY_SIZE) == 0)
|
||||
- _gnutls_switch_lib_state(LIB_STATE_ERROR);
|
||||
-
|
||||
- xts_aes256_set_decrypt_key(xts_key, key);
|
||||
-}
|
||||
-
|
||||
-static void
|
||||
_xts_aes128_encrypt(struct nettle_cipher_ctx *ctx, size_t length, uint8_t * dst,
|
||||
const uint8_t * src)
|
||||
{
|
||||
@@ -1041,8 +999,8 @@ static const struct nettle_cipher_st bui
|
||||
.ctx_size = sizeof(struct xts_aes128_key),
|
||||
.encrypt = _xts_aes128_encrypt,
|
||||
.decrypt = _xts_aes128_decrypt,
|
||||
- .set_encrypt_key = (nettle_set_key_func*)_xts_aes128_set_encrypt_key,
|
||||
- .set_decrypt_key = (nettle_set_key_func*)_xts_aes128_set_decrypt_key,
|
||||
+ .set_encrypt_key = (nettle_set_key_func*)xts_aes128_set_encrypt_key,
|
||||
+ .set_decrypt_key = (nettle_set_key_func*)xts_aes128_set_decrypt_key,
|
||||
.max_iv_size = AES_BLOCK_SIZE,
|
||||
},
|
||||
{ .algo = GNUTLS_CIPHER_AES_256_XTS,
|
||||
@@ -1052,8 +1010,8 @@ static const struct nettle_cipher_st bui
|
||||
.ctx_size = sizeof(struct xts_aes256_key),
|
||||
.encrypt = _xts_aes256_encrypt,
|
||||
.decrypt = _xts_aes256_decrypt,
|
||||
- .set_encrypt_key = (nettle_set_key_func*)_xts_aes256_set_encrypt_key,
|
||||
- .set_decrypt_key = (nettle_set_key_func*)_xts_aes256_set_decrypt_key,
|
||||
+ .set_encrypt_key = (nettle_set_key_func*)xts_aes256_set_encrypt_key,
|
||||
+ .set_decrypt_key = (nettle_set_key_func*)xts_aes256_set_decrypt_key,
|
||||
.max_iv_size = AES_BLOCK_SIZE,
|
||||
},
|
||||
{ .algo = GNUTLS_CIPHER_AES_128_SIV,
|
||||
@@ -1144,6 +1102,21 @@ wrap_nettle_cipher_setkey(void *_ctx, co
|
||||
return 0;
|
||||
}
|
||||
|
||||
+ switch (ctx->cipher->algo) {
|
||||
+ case GNUTLS_CIPHER_AES_128_XTS:
|
||||
+ if (_gnutls_fips_mode_enabled() &&
|
||||
+ gnutls_memcmp(key, (char *)key + AES128_KEY_SIZE, AES128_KEY_SIZE) == 0)
|
||||
+ return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
|
||||
+ break;
|
||||
+ case GNUTLS_CIPHER_AES_256_XTS:
|
||||
+ if (_gnutls_fips_mode_enabled() &&
|
||||
+ gnutls_memcmp(key, (char *)key + AES256_KEY_SIZE, AES256_KEY_SIZE) == 0)
|
||||
+ return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
|
||||
+ break;
|
||||
+ default:
|
||||
+ break;
|
||||
+ }
|
||||
+
|
||||
if (ctx->enc)
|
||||
ctx->cipher->set_encrypt_key(ctx->ctx_ptr, key);
|
||||
else
|
||||
diff --color -ruNp a/tests/Makefile.am b/tests/Makefile.am
|
||||
--- a/tests/Makefile.am 2022-11-07 14:10:13.836089211 +0100
|
||||
+++ b/tests/Makefile.am 2022-11-07 14:12:38.478982790 +0100
|
||||
@@ -233,7 +233,7 @@ ctests += mini-record-2 simple gnutls_hm
|
||||
tls13-without-timeout-func buffer status-request-revoked \
|
||||
set_x509_ocsp_multi_cli kdf-api keylog-func handshake-write \
|
||||
x509cert-dntypes id-on-xmppAddr tls13-compat-mode ciphersuite-name \
|
||||
- x509-upnconstraint pkcs7-verify-double-free \
|
||||
+ x509-upnconstraint xts-key-check pkcs7-verify-double-free \
|
||||
fips-rsa-sizes
|
||||
|
||||
ctests += tls-channel-binding
|
||||
diff --color -ruNp a/tests/xts-key-check.c b/tests/xts-key-check.c
|
||||
--- a/tests/xts-key-check.c 1970-01-01 01:00:00.000000000 +0100
|
||||
+++ b/tests/xts-key-check.c 2022-11-07 14:12:38.478982790 +0100
|
||||
@@ -0,0 +1,78 @@
|
||||
+/*
|
||||
+ * Copyright (C) 2022 Red Hat, Inc.
|
||||
+ *
|
||||
+ * Author: Zoltan Fridrich
|
||||
+ *
|
||||
+ * This file is part of GnuTLS.
|
||||
+ *
|
||||
+ * GnuTLS is free software: you can redistribute it and/or modify it
|
||||
+ * under the terms of the GNU General Public License as published by
|
||||
+ * the Free Software Foundation, either version 3 of the License, or
|
||||
+ * (at your option) any later version.
|
||||
+ *
|
||||
+ * GnuTLS is distributed in the hope that it will be useful, but
|
||||
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
+ * General Public License for more details.
|
||||
+ *
|
||||
+ * You should have received a copy of the GNU General Public License
|
||||
+ * along with GnuTLS. If not, see <https://www.gnu.org/licenses/>.
|
||||
+ */
|
||||
+
|
||||
+#ifdef HAVE_CONFIG_H
|
||||
+#include <config.h>
|
||||
+#endif
|
||||
+
|
||||
+#include <gnutls/crypto.h>
|
||||
+
|
||||
+#include "utils.h"
|
||||
+
|
||||
+static void test_xts_check(gnutls_cipher_algorithm_t alg)
|
||||
+{
|
||||
+ int ret;
|
||||
+ gnutls_cipher_hd_t ctx;
|
||||
+ gnutls_datum_t key, iv;
|
||||
+
|
||||
+ iv.size = gnutls_cipher_get_iv_size(alg);
|
||||
+ iv.data = gnutls_malloc(iv.size);
|
||||
+ if (iv.data == NULL)
|
||||
+ fail("Error: %s\n", gnutls_strerror(GNUTLS_E_MEMORY_ERROR));
|
||||
+ gnutls_memset(iv.data, 0xf0, iv.size);
|
||||
+
|
||||
+ key.size = gnutls_cipher_get_key_size(alg);
|
||||
+ key.data = gnutls_malloc(key.size);
|
||||
+ if (key.data == NULL) {
|
||||
+ gnutls_free(iv.data);
|
||||
+ fail("Error: %s\n", gnutls_strerror(GNUTLS_E_MEMORY_ERROR));
|
||||
+ }
|
||||
+ gnutls_memset(key.data, 0xf0, key.size);
|
||||
+
|
||||
+ ret = gnutls_cipher_init(&ctx, alg, &key, &iv);
|
||||
+ if (ret == GNUTLS_E_SUCCESS) {
|
||||
+ gnutls_cipher_deinit(ctx);
|
||||
+ gnutls_free(iv.data);
|
||||
+ gnutls_free(key.data);
|
||||
+ fail("cipher initialization should fail for key1 == key2\n");
|
||||
+ }
|
||||
+
|
||||
+ key.data[0] = 0xff;
|
||||
+
|
||||
+ ret = gnutls_cipher_init(&ctx, alg, &key, &iv);
|
||||
+ gnutls_free(iv.data);
|
||||
+ gnutls_free(key.data);
|
||||
+
|
||||
+ if (ret == GNUTLS_E_SUCCESS)
|
||||
+ gnutls_cipher_deinit(ctx);
|
||||
+ else
|
||||
+ fail("cipher initialization should succeed with key1 != key2"
|
||||
+ "\n%s\n", gnutls_strerror(ret));
|
||||
+}
|
||||
+
|
||||
+void doit(void)
|
||||
+{
|
||||
+ if (!gnutls_fips140_mode_enabled())
|
||||
+ exit(77);
|
||||
+
|
||||
+ test_xts_check(GNUTLS_CIPHER_AES_128_XTS);
|
||||
+ test_xts_check(GNUTLS_CIPHER_AES_256_XTS);
|
||||
+}
|
|
@ -1,55 +1,20 @@
|
|||
%define srpmhash() %{lua:
|
||||
local files = rpm.expand("%_specdir/gnutls.spec")
|
||||
for i, p in ipairs(patches) do
|
||||
files = files.." "..p
|
||||
end
|
||||
for i, p in ipairs(sources) do
|
||||
files = files.." "..p
|
||||
end
|
||||
local sha256sum = assert(io.popen("cat "..files.."| sha256sum"))
|
||||
local hash = sha256sum:read("*a")
|
||||
sha256sum:close()
|
||||
print(string.sub(hash, 0, 16))
|
||||
}
|
||||
|
||||
Version: 3.7.6
|
||||
Release: 21%{?dist}
|
||||
# not upstreamed
|
||||
Patch: gnutls-3.6.7-no-now-guile.patch
|
||||
Patch: gnutls-3.2.7-rpath.patch
|
||||
Patch: gnutls-3.7.2-enable-intel-cet.patch
|
||||
Patch: gnutls-3.7.2-no-explicit-init.patch
|
||||
|
||||
# upstreamed
|
||||
Patch: gnutls-3.7.6-fips-run-selftests.patch
|
||||
Patch: gnutls-3.7.6-ktls-disable-by-default.patch
|
||||
Patch: gnutls-3.7.6-ktls-fixes.patch
|
||||
Patch: gnutls-3.7.6-aes-gcm-pt-limit.patch
|
||||
Patch: gnutls-3.7.6-pkcs7-verify.patch
|
||||
Patch: gnutls-3.7.6-fips-pkcs12-des-cbc.patch
|
||||
Patch: gnutls-3.7.6-fips-rsa-key-sizes.patch
|
||||
Patch: gnutls-3.7.6-fips-symkey-limit.patch
|
||||
Patch: gnutls-3.7.6-fips-ecdsa-hash-check.patch
|
||||
Patch: gnutls-3.7.8-xts-key-check.patch
|
||||
Patch: gnutls-3.7.8-clear-session-ticket.patch
|
||||
Patch: gnutls-3.7.7-aes-cbc-padding-support.patch
|
||||
Patch: gnutls-3.7.8-integrity-check.patch
|
||||
Patch: gnutls-3.7.6-fips-service-indicator-test-functions.patch
|
||||
Patch: gnutls-3.7.6-fips-ccm-taglen.patch
|
||||
Patch: gnutls-3.7.6-fips-rsa-pss-saltlen.patch
|
||||
Patch: gnutls-3.7.8-revert-hmac-name.patch
|
||||
Patch: gnutls-3.7.8-rsa-kx-timing.patch
|
||||
Patch: gnutls-3.7.8-fips-pct-dh.patch
|
||||
Patch: gnutls-3.7.6-fips-ems.patch
|
||||
|
||||
# not upstreamed
|
||||
Patch: gnutls-3.7.3-disable-config-reload.patch
|
||||
Patch: gnutls-3.7.3-fips-dsa-post.patch
|
||||
Patch: gnutls-3.7.6-drbg-reseed.patch
|
||||
Patch: gnutls-3.7.6-cpuid-fixes.patch
|
||||
Patch: gnutls-3.7.6-gmp-static.patch
|
||||
|
||||
%bcond_without bootstrap
|
||||
Version: 3.6.16
|
||||
Release: 8%{?dist}.3
|
||||
Patch1: gnutls-3.2.7-rpath.patch
|
||||
Patch2: gnutls-3.6.4-no-now-guile.patch
|
||||
Patch3: gnutls-3.6.13-enable-intel-cet.patch
|
||||
Patch10: gnutls-3.6.14-fips-dh-selftests.patch
|
||||
Patch11: gnutls-3.6.14-fips-kdf-selftests.patch
|
||||
Patch12: gnutls-3.6.16-tls12-cert-type.patch
|
||||
Patch13: gnutls-3.6.16-trust-ca-sha1.patch
|
||||
Patch14: gnutls-3.6.16-doc-p11tool-ckaid.patch
|
||||
Patch15: gnutls-3.6.16-pkcs7-verify.patch
|
||||
Patch16: gnutls-3.6.16-cpuid.patch
|
||||
Patch17: gnutls-3.7.8-rsa-kx-timing.patch
|
||||
Patch18: gnutls-3.6.16-rehandshake-tickets.patch
|
||||
Patch19: gnutls-3.6.16-rsa-psk-timing.patch
|
||||
Patch20: gnutls-3.6.16-rsa-psk-timing-followup.patch
|
||||
Patch21: gnutls-3.6.16-deterministic-ecdsa-fixes.patch
|
||||
%bcond_without dane
|
||||
%if 0%{?rhel}
|
||||
%bcond_with guile
|
||||
|
@ -58,37 +23,25 @@ Patch: gnutls-3.7.6-gmp-static.patch
|
|||
%bcond_without guile
|
||||
%bcond_without fips
|
||||
%endif
|
||||
%bcond_with tpm12
|
||||
%bcond_without tpm2
|
||||
%bcond_with gost
|
||||
%bcond_with certificate_compression
|
||||
%bcond_without tests
|
||||
|
||||
Summary: A TLS protocol implementation
|
||||
Name: gnutls
|
||||
# The libraries are LGPLv2.1+, utilities are GPLv3+
|
||||
License: GPLv3+ and LGPLv2+
|
||||
Group: System Environment/Libraries
|
||||
BuildRequires: p11-kit-devel >= 0.21.3, gettext-devel
|
||||
BuildRequires: readline-devel, libtasn1-devel >= 4.3
|
||||
%if %{with certificate_compression}
|
||||
BuildRequires: zlib-devel, brotli-devel, libzstd-devel
|
||||
%endif
|
||||
%if %{with bootstrap}
|
||||
BuildRequires: automake, autoconf, gperf, libtool
|
||||
%endif
|
||||
BuildRequires: texinfo
|
||||
BuildRequires: nettle-devel >= 3.5.1
|
||||
%if %{with tpm12}
|
||||
BuildRequires: zlib-devel, readline-devel, libtasn1-devel >= 4.3
|
||||
BuildRequires: libtool, automake, autoconf, texinfo
|
||||
BuildRequires: autogen-libopts-devel >= 5.18 autogen
|
||||
BuildRequires: nettle-devel >= 3.4.1
|
||||
BuildRequires: trousers-devel >= 0.3.11.2
|
||||
%endif
|
||||
%if %{with tpm2}
|
||||
BuildRequires: tpm2-tss-devel >= 3.0.3
|
||||
%endif
|
||||
BuildRequires: libidn2-devel
|
||||
BuildRequires: libunistring-devel
|
||||
BuildRequires: net-tools, datefudge, softhsm, gcc, gcc-c++
|
||||
BuildRequires: gperf, net-tools, datefudge, softhsm, gcc, gcc-c++
|
||||
BuildRequires: gnupg2
|
||||
BuildRequires: git-core
|
||||
%if %{with fips}
|
||||
BuildRequires: fipscheck
|
||||
%endif
|
||||
|
||||
# for a sanity check on cert loading
|
||||
BuildRequires: p11-kit-trust, ca-certificates
|
||||
|
@ -96,25 +49,18 @@ Requires: crypto-policies
|
|||
Requires: p11-kit-trust
|
||||
Requires: libtasn1 >= 4.3
|
||||
Requires: nettle >= 3.4.1
|
||||
%if %{with tpm12}
|
||||
Recommends: trousers >= 0.3.11.2
|
||||
%endif
|
||||
|
||||
%if %{with dane}
|
||||
BuildRequires: unbound-devel unbound-libs
|
||||
%endif
|
||||
%if %{with guile}
|
||||
BuildRequires: guile22-devel
|
||||
BuildRequires: guile-devel
|
||||
%endif
|
||||
BuildRequires: make
|
||||
URL: http://www.gnutls.org/
|
||||
Source0: https://www.gnupg.org/ftp/gcrypt/gnutls/v3.7/%{name}-%{version}.tar.xz
|
||||
Source1: https://www.gnupg.org/ftp/gcrypt/gnutls/v3.7/%{name}-%{version}.tar.xz.sig
|
||||
Source2: gnutls-release-keyring.gpg
|
||||
|
||||
Source100: gmp-6.2.1.tar.xz
|
||||
# Taken from the main gmp package
|
||||
Source101: gmp-6.2.1-intel-cet.patch
|
||||
Source0: ftp://ftp.gnutls.org/gcrypt/gnutls/v3.6/%{name}-%{version}.tar.xz
|
||||
Source1: ftp://ftp.gnutls.org/gcrypt/gnutls/v3.6/%{name}-%{version}.tar.xz.sig
|
||||
Source2: gpgkey-462225C3B46F34879FC8496CD605848ED7E69871.gpg
|
||||
|
||||
# Wildcard bundling exception https://fedorahosted.org/fpc/ticket/174
|
||||
Provides: bundled(gnulib) = 20130424
|
||||
|
@ -125,16 +71,20 @@ Requires: %{name}%{?_isa} = %{version}-%{release}
|
|||
|
||||
%package devel
|
||||
Summary: Development files for the %{name} package
|
||||
Group: Development/Libraries
|
||||
Requires: %{name}%{?_isa} = %{version}-%{release}
|
||||
Requires: %{name}-c++%{?_isa} = %{version}-%{release}
|
||||
%if %{with dane}
|
||||
Requires: %{name}-dane%{?_isa} = %{version}-%{release}
|
||||
%endif
|
||||
Requires: pkgconfig
|
||||
Requires(post): /sbin/install-info
|
||||
Requires(preun): /sbin/install-info
|
||||
|
||||
%package utils
|
||||
License: GPLv3+
|
||||
Summary: Command line tools for TLS protocol
|
||||
Group: Applications/System
|
||||
Requires: %{name}%{?_isa} = %{version}-%{release}
|
||||
%if %{with dane}
|
||||
Requires: %{name}-dane%{?_isa} = %{version}-%{release}
|
||||
|
@ -149,8 +99,9 @@ Requires: %{name}%{?_isa} = %{version}-%{release}
|
|||
%if %{with guile}
|
||||
%package guile
|
||||
Summary: Guile bindings for the GNUTLS library
|
||||
Group: Development/Libraries
|
||||
Requires: %{name}%{?_isa} = %{version}-%{release}
|
||||
Requires: guile22
|
||||
Requires: guile
|
||||
%endif
|
||||
|
||||
%description
|
||||
|
@ -207,169 +158,91 @@ This package contains Guile bindings for the library.
|
|||
%endif
|
||||
|
||||
%prep
|
||||
%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
|
||||
gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0}
|
||||
|
||||
%autosetup -p1 -S git
|
||||
|
||||
%if %{with fips}
|
||||
mkdir -p bundled_gmp
|
||||
pushd bundled_gmp
|
||||
tar --strip-components=1 -xf %{SOURCE100}
|
||||
patch -p1 < %{SOURCE101}
|
||||
popd
|
||||
%endif
|
||||
|
||||
%build
|
||||
%ifarch aarch64 ppc64le
|
||||
%define _lto_cflags %{nil}
|
||||
%endif
|
||||
|
||||
%if %{with fips}
|
||||
pushd bundled_gmp
|
||||
autoreconf -ifv
|
||||
%configure --disable-cxx --disable-shared --enable-fat --with-pic
|
||||
%make_build
|
||||
popd
|
||||
|
||||
export GMP_CFLAGS="-I$PWD/bundled_gmp"
|
||||
export GMP_LIBS="$PWD/bundled_gmp/.libs/libgmp.a"
|
||||
%endif
|
||||
|
||||
%if %{with bootstrap}
|
||||
autoreconf -fi
|
||||
%endif
|
||||
|
||||
sed -i -e 's|sys_lib_dlsearch_path_spec="/lib /usr/lib|sys_lib_dlsearch_path_spec="/lib /usr/lib %{_libdir}|g' configure
|
||||
rm -f lib/minitasn1/*.c lib/minitasn1/*.h
|
||||
rm -f src/libopts/*.c src/libopts/*.h src/libopts/compat/*.c src/libopts/compat/*.h
|
||||
|
||||
echo "SYSTEM=NORMAL" >> tests/system.prio
|
||||
|
||||
%if %{with guile}
|
||||
# These should be checked by m4/guile.m4 instead of configure.ac
|
||||
# taking into account of _guile_suffix
|
||||
guile_snarf=%{_bindir}/guile-snarf2.2
|
||||
export guile_snarf
|
||||
GUILD=%{_bindir}/guild2.2
|
||||
export GUILD
|
||||
%endif
|
||||
# Note that we explicitly enable SHA1, as SHA1 deprecation is handled
|
||||
# via the crypto policies
|
||||
|
||||
%if %{with fips}
|
||||
eval $(sed -n 's/^\(\(NAME\|VERSION_ID\)=.*\)/OS_\1/p' /etc/os-release)
|
||||
export FIPS_MODULE_NAME="$OS_NAME ${OS_VERSION_ID%%.*} %name"
|
||||
%endif
|
||||
|
||||
%configure \
|
||||
%build
|
||||
autoreconf -fi
|
||||
CCASFLAGS="$CCASFLAGS -Wa,--generate-missing-build-notes=yes"
|
||||
export CCASFLAGS
|
||||
%configure --with-libtasn1-prefix=%{_prefix} \
|
||||
%if %{with fips}
|
||||
--enable-fips140-mode \
|
||||
--with-fips140-module-name="$FIPS_MODULE_NAME" \
|
||||
--with-fips140-module-version=%{version}-%{srpmhash} \
|
||||
%endif
|
||||
%if %{with gost}
|
||||
--enable-gost \
|
||||
%else
|
||||
--disable-gost \
|
||||
%endif
|
||||
--enable-tls13-support \
|
||||
--enable-sha1-support \
|
||||
--disable-static \
|
||||
--disable-openssl-compatibility \
|
||||
--disable-non-suiteb-curves \
|
||||
--with-system-priority-file=%{_sysconfdir}/crypto-policies/back-ends/gnutls.config \
|
||||
--with-default-trust-store-pkcs11="pkcs11:" \
|
||||
%if %{with tpm12}
|
||||
--with-trousers-lib=%{_libdir}/libtspi.so.1 \
|
||||
%else
|
||||
--without-tpm \
|
||||
%endif
|
||||
%if %{with tpm2}
|
||||
--with-tpm2 \
|
||||
%else
|
||||
--without-tpm2 \
|
||||
%endif
|
||||
--enable-ktls \
|
||||
--htmldir=%{_docdir}/manual \
|
||||
%if %{with guile}
|
||||
--enable-guile \
|
||||
--with-guile-extension-dir=%{_libdir}/guile/2.2 \
|
||||
%else
|
||||
--disable-guile \
|
||||
%endif
|
||||
%if %{with dane}
|
||||
--with-unbound-root-key-file=/var/lib/unbound/root.key \
|
||||
--enable-libdane \
|
||||
--enable-dane \
|
||||
%else
|
||||
--disable-libdane \
|
||||
%endif
|
||||
%if %{with certificate_compression}
|
||||
--with-zlib --with-brotli --with-zstd \
|
||||
%else
|
||||
--without-zlib --without-brotli --without-zstd \
|
||||
--disable-dane \
|
||||
%endif
|
||||
--disable-rpath \
|
||||
--with-default-priority-string="@SYSTEM"
|
||||
|
||||
# build libgnutlsxx.so with older SONAME
|
||||
make %{?_smp_mflags} V=1 CXX_LT_CURRENT=29 CXX_LT_REVISION=0 CXX_LT_AGE=1
|
||||
|
||||
%install
|
||||
make install DESTDIR=$RPM_BUILD_ROOT
|
||||
|
||||
# build libgnutlsxx.so with newer SONAME
|
||||
pushd lib
|
||||
rm -f libgnutlsxx.la
|
||||
make %{?_smp_mflags} V=1
|
||||
make install DESTDIR=$RPM_BUILD_ROOT
|
||||
popd
|
||||
touch doc/examples/ex-cxx
|
||||
|
||||
make -C doc install-html DESTDIR=$RPM_BUILD_ROOT
|
||||
|
||||
rm -f $RPM_BUILD_ROOT%{_infodir}/dir
|
||||
rm -f $RPM_BUILD_ROOT%{_libdir}/*.la
|
||||
rm -f $RPM_BUILD_ROOT%{_libdir}/guile/2.2/guile-gnutls*.a
|
||||
rm -f $RPM_BUILD_ROOT%{_libdir}/guile/2.2/guile-gnutls*.la
|
||||
%if %{without dane}
|
||||
rm -f $RPM_BUILD_ROOT%{_libdir}/pkgconfig/gnutls-dane.pc
|
||||
%endif
|
||||
|
||||
%if %{with fips}
|
||||
# doing it twice should be a no-op the second time,
|
||||
# and this way we avoid redefining it and missing a future change
|
||||
%{__spec_install_post}
|
||||
fname=`basename $RPM_BUILD_ROOT%{_libdir}/libgnutls.so.30.*.*`
|
||||
./lib/fipshmac "$RPM_BUILD_ROOT%{_libdir}/libgnutls.so.30" > "$RPM_BUILD_ROOT%{_libdir}/.$fname.hmac"
|
||||
sed -i "s^$RPM_BUILD_ROOT/usr^^" "$RPM_BUILD_ROOT%{_libdir}/.$fname.hmac"
|
||||
ln -s ".$fname.hmac" "$RPM_BUILD_ROOT%{_libdir}/.libgnutls.so.30.hmac"
|
||||
%endif
|
||||
|
||||
%if %{with fips}
|
||||
%define __spec_install_post \
|
||||
%{?__debug_package:%{__debug_install_post}} \
|
||||
%{__arch_install_post} \
|
||||
%{__os_install_post} \
|
||||
fipshmac -d $RPM_BUILD_ROOT%{_libdir} $RPM_BUILD_ROOT%{_libdir}/libgnutls.so.30.*.* \
|
||||
file=`basename $RPM_BUILD_ROOT%{_libdir}/libgnutls.so.30.*.hmac` && mv $RPM_BUILD_ROOT%{_libdir}/$file $RPM_BUILD_ROOT%{_libdir}/.$file && ln -s .$file $RPM_BUILD_ROOT%{_libdir}/.libgnutls.so.30.hmac \
|
||||
%{nil}
|
||||
%endif
|
||||
|
||||
%install
|
||||
make install DESTDIR=$RPM_BUILD_ROOT
|
||||
make -C doc install-html DESTDIR=$RPM_BUILD_ROOT
|
||||
rm -f $RPM_BUILD_ROOT%{_infodir}/dir
|
||||
rm -f $RPM_BUILD_ROOT%{_libdir}/*.la
|
||||
rm -f $RPM_BUILD_ROOT%{_libdir}/guile/2.0/guile-gnutls*.a
|
||||
rm -f $RPM_BUILD_ROOT%{_libdir}/guile/2.0/guile-gnutls*.la
|
||||
rm -f $RPM_BUILD_ROOT%{_libdir}/gnutls/libpkcs11mock1.*
|
||||
%if %{without dane}
|
||||
rm -f $RPM_BUILD_ROOT%{_libdir}/pkgconfig/gnutls-dane.pc
|
||||
%endif
|
||||
|
||||
%find_lang gnutls
|
||||
|
||||
%check
|
||||
%if %{with tests}
|
||||
make check %{?_smp_mflags}
|
||||
|
||||
xfail_tests=
|
||||
%post devel
|
||||
if [ -f %{_infodir}/gnutls.info.gz ]; then
|
||||
/sbin/install-info %{_infodir}/gnutls.info.gz %{_infodir}/dir || :
|
||||
fi
|
||||
|
||||
# With older kernel, key installation fails if the host is x86_64 and
|
||||
# the package is built with -m32:
|
||||
%ifarch %{ix86}
|
||||
case "$(uname -r)" in
|
||||
4.*.x86_64)
|
||||
xfail_tests="$xfail_tests ktls.sh"
|
||||
;;
|
||||
esac
|
||||
%endif
|
||||
|
||||
make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null XFAIL_TESTS="$xfail_tests"
|
||||
%endif
|
||||
%preun devel
|
||||
if [ $1 = 0 -a -f %{_infodir}/gnutls.info.gz ]; then
|
||||
/sbin/install-info --delete %{_infodir}/gnutls.info.gz %{_infodir}/dir || :
|
||||
fi
|
||||
|
||||
%files -f gnutls.lang
|
||||
%defattr(-,root,root,-)
|
||||
%{_libdir}/libgnutls.so.30*
|
||||
%if %{with fips}
|
||||
%{_libdir}/.libgnutls.so.30*.hmac
|
||||
|
@ -381,8 +254,13 @@ make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null XFAIL_TESTS="$x
|
|||
%{_libdir}/libgnutlsxx.so.*
|
||||
|
||||
%files devel
|
||||
%defattr(-,root,root,-)
|
||||
%{_includedir}/*
|
||||
%{_libdir}/libgnutls*.so
|
||||
%if %{with fips}
|
||||
%{_libdir}/.libgnutls.so.*.hmac
|
||||
%endif
|
||||
|
||||
%{_libdir}/pkgconfig/*.pc
|
||||
%{_mandir}/man3/*
|
||||
%{_infodir}/gnutls*
|
||||
|
@ -390,10 +268,9 @@ make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null XFAIL_TESTS="$x
|
|||
%{_docdir}/manual/*
|
||||
|
||||
%files utils
|
||||
%defattr(-,root,root,-)
|
||||
%{_bindir}/certtool
|
||||
%if %{with tpm12}
|
||||
%{_bindir}/tpmtool
|
||||
%endif
|
||||
%{_bindir}/ocsptool
|
||||
%{_bindir}/psktool
|
||||
%{_bindir}/p11tool
|
||||
|
@ -407,359 +284,184 @@ make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null XFAIL_TESTS="$x
|
|||
|
||||
%if %{with dane}
|
||||
%files dane
|
||||
%defattr(-,root,root,-)
|
||||
%{_libdir}/libgnutls-dane.so.*
|
||||
%endif
|
||||
|
||||
%if %{with guile}
|
||||
%files guile
|
||||
%{_libdir}/guile/2.2/guile-gnutls*.so*
|
||||
%{_libdir}/guile/2.2/site-ccache/gnutls.go
|
||||
%{_libdir}/guile/2.2/site-ccache/gnutls/extra.go
|
||||
%{_datadir}/guile/site/2.2/gnutls.scm
|
||||
%{_datadir}/guile/site/2.2/gnutls/extra.scm
|
||||
%defattr(-,root,root,-)
|
||||
%{_libdir}/guile/2.0/guile-gnutls*.so*
|
||||
%{_libdir}/guile/2.0/site-ccache/gnutls.go
|
||||
%{_libdir}/guile/2.0/site-ccache/gnutls/extra.go
|
||||
%{_datadir}/guile/site/2.0/gnutls.scm
|
||||
%{_datadir}/guile/site/2.0/gnutls/extra.scm
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
* Thu Jul 13 2023 Daiki Ueno <dueno@redhat.com> - 3.7.6-21
|
||||
- Require use of extended master secret in FIPS mode by default (#2227257)
|
||||
- Skip KTLS test on old kernel if host and target arches are different
|
||||
* Tue Mar 26 2024 Daiki Ueno <dueno@redhat.com> - 3.6.16-8.3
|
||||
- Fix memleak with older GMP (RHEL-28957)
|
||||
|
||||
* Tue Mar 14 2023 Daiki Ueno <dueno@redhat.com> - 3.7.6-20
|
||||
- Fix the previous change (#2175214)
|
||||
* Mon Mar 25 2024 Daiki Ueno <dueno@redhat.com> - 3.6.16-8.2
|
||||
- Fix timing side-channel in deterministic ECDSA (RHEL-28957)
|
||||
|
||||
* Fri Mar 10 2023 Daiki Ueno <dueno@redhat.com> - 3.7.6-19
|
||||
- Bump release to ensure el9 package is greater than el9_* packages (#2175214)
|
||||
* Thu Jan 18 2024 Daiki Ueno <dueno@redhat.com> - 3.6.16-8.1
|
||||
- auth/rsa-psk: minimize branching after decryption (RHEL-21586)
|
||||
|
||||
* Tue Feb 28 2023 Daiki Ueno <dueno@redhat.com> - 3.7.6-18
|
||||
- Update gnutls-3.7.8-fips-pct-dh.patch to the upstream version (#2168143)
|
||||
* Wed Dec 6 2023 Daiki Ueno <dueno@redhat.com> - 3.6.16-8
|
||||
- auth/rsa_psk: side-step potential side-channel (RHEL-16753)
|
||||
|
||||
* Fri Feb 10 2023 Daiki Ueno <dueno@redhat.com> - 3.7.6-17
|
||||
- Fix timing side-channel in TLS RSA key exchange (#2162601)
|
||||
* Mon Jun 26 2023 Daiki Ueno <dueno@redhat.com> - 3.6.16-7
|
||||
- Clear server's session ticket indication at rehandshake (#2089817)
|
||||
|
||||
* Fri Feb 10 2023 Daiki Ueno <dueno@redhat.com> - 3.7.6-16
|
||||
- fips: extend PCT to DH key generation (#2168143)
|
||||
* Thu Feb 23 2023 Zoltan Fridrich <zfridric@redhat.com> - 3.6.16-6
|
||||
- Fix x86_64 CPU feature detection when AVX is not available (#2131152)
|
||||
- Fix timing side-channel in TLS RSA key exchange (#2162598)
|
||||
|
||||
* Thu Dec 15 2022 Zoltan Fridrich <zfridric@redhat.com> - 3.7.6-15
|
||||
- fips: rename hmac file to its previous name (#2148269)
|
||||
* Mon Aug 29 2022 Daiki Ueno <dueno@redhat.com> - 3.6.16-5
|
||||
- Fix double-free in gnutls_pkcs7_verify (#2109788)
|
||||
|
||||
* Tue Nov 22 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-14
|
||||
- cipher: add restriction on CCM tag length under FIPS mode (#2137807)
|
||||
- nettle: mark non-compliant RSA-PSS salt length to be not-approved (#2143266)
|
||||
* Mon Jun 28 2021 Daiki Ueno <dueno@redhat.com> - 3.6.16-4
|
||||
- p11tool: Document ID reuse behavior when importing certs (#1776250)
|
||||
|
||||
* Tue Nov 15 2022 Zoltan Fridrich <zfridric@redhat.com> - 3.7.6-13
|
||||
- fips: make XTS key check failure not fatal (#2130971)
|
||||
- enable source archive verification again (#2127094)
|
||||
- clear server's session ticket indication at rehandshake (#2136072)
|
||||
- crypto-api: add block cipher API with automatic padding (#2084161)
|
||||
- fips: remove library path checking from FIPS integrity check (#2140908)
|
||||
* Mon Jun 7 2021 Daiki Ueno <dueno@redhat.com> - 3.6.16-3
|
||||
- Treat SHA-1 signed CA in the trusted set differently (#1965445)
|
||||
|
||||
* Tue Sep 27 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-12
|
||||
- fips: mark PBKDF2 with short key and output sizes non-approved
|
||||
- fips: only mark HMAC as approved in PBKDF2
|
||||
- fips: mark gnutls_key_generate with short key sizes non-approved
|
||||
- fips: fix checking on hash algorithm used in ECDSA
|
||||
- fips: preserve operation context around FIPS selftests API
|
||||
* Wed May 26 2021 Daiki Ueno <dueno@redhat.com> - 3.6.16-2
|
||||
- Filter certificate_types in TLS 1.2 CR based on signature algorithms (#1942216)
|
||||
|
||||
* Fri Aug 26 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-11
|
||||
- Supply --with{,out}-{zlib,brotli,zstd} explicitly
|
||||
* Mon May 24 2021 Daiki Ueno <dueno@redhat.com> - 3.6.16-1
|
||||
- Update to upstream 3.6.16 release (#1956783)
|
||||
- Fix potential use-after-free in key_share handling (#1927597)
|
||||
- Fix potential use-after-free in pre_shared_key handling (#1927593)
|
||||
- Stop gnutls-serv relying on AI_ADDRCONFIG to decide listening address (#1908334)
|
||||
- Fix cert expiration issue in tests (#1908110)
|
||||
|
||||
* Thu Aug 25 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-10
|
||||
- Revert nettle version pinning as it doesn't work well in side-tag
|
||||
* Thu Apr 1 2021 Daiki Ueno <dueno@redhat.com> - 3.6.14-10
|
||||
- Port fixes for potential miscalculation in ecdsa_verify (#1942931)
|
||||
|
||||
* Thu Aug 25 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-9
|
||||
- Pin nettle version in Requires when compiled with FIPS
|
||||
* Tue Nov 24 2020 Daiki Ueno <dueno@redhat.com> - 3.6.14-9
|
||||
- Revert the previous change
|
||||
|
||||
* Tue Aug 23 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-8
|
||||
- Bundle GMP to privatize memory functions
|
||||
- Disable certificate compression support by default
|
||||
* Wed Nov 11 2020 Daiki Ueno <dueno@redhat.com> - 3.6.14-8
|
||||
- Depend on specific NVR of gmp and nettle (#1812933)
|
||||
|
||||
* Tue Aug 23 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-7
|
||||
- Update gnutls-3.7.6-cpuid-fixes.patch
|
||||
* Tue Nov 3 2020 Daiki Ueno <dueno@redhat.com> - 3.6.14-7
|
||||
- Increase DH key bits to >= 2048 in self-tests (#1879506)
|
||||
- Implement self-tests for KDF and CMAC (#1890870)
|
||||
- Fix CVE-2020-24659: heap buffer-overflow when "no_renegotiation" alert is received (#1873959)
|
||||
|
||||
* Sat Aug 20 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-6
|
||||
- Mark RSA SigVer operation approved for known modulus sizes (#2091903)
|
||||
- accelerated: clear AVX bits if it cannot be queried through XSAVE
|
||||
* Mon Aug 24 2020 Daiki Ueno <dueno@redhat.com> - 3.6.14-6
|
||||
- Fix memory leak when serializing iovec_t (#1844112)
|
||||
|
||||
* Thu Aug 4 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-5
|
||||
- Block DES-CBC usage in decrypting PKCS#12 bag under FIPS (#2115244)
|
||||
- sysrng: reseed source DRBG for prediction resistance
|
||||
* Sat Jul 18 2020 Daiki Ueno <dueno@redhat.com> - 3.6.14-5
|
||||
- Perform validation checks on (EC)DH public keys and share secrets (#1855803)
|
||||
|
||||
* Fri Jul 29 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-4
|
||||
- Make gnutls-cli work with KTLS for testing
|
||||
- Fix double-free in gnutls_pkcs7_verify (#2109790)
|
||||
* Mon Jun 29 2020 Daiki Ueno <dueno@redhat.com> - 3.6.14-4
|
||||
- Tighten FIPS DH primes check according to SP800-56A (rev 3) (#1849079)
|
||||
|
||||
* Mon Jul 25 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-3
|
||||
- Limit input size for AES-GCM according to SP800-38D (#2095251)
|
||||
- Do not treat GPG verification errors as fatal
|
||||
- Remove gnutls-3.7.6-libgnutlsxx-const.patch
|
||||
* Fri Jun 5 2020 Daiki Ueno <dueno@redhat.com> - 3.6.14-3
|
||||
- Update gnutls-3.6.14-fips-mode-check.patch
|
||||
|
||||
* Tue Jul 19 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-2
|
||||
- Allow enabling KTLS with config file (#2042009)
|
||||
|
||||
* Fri Jul 1 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-1
|
||||
- Update to gnutls 3.7.6 (#2097327)
|
||||
|
||||
* Thu Mar 31 2022 Daiki Ueno <dueno@redhat.com> - 3.7.3-10
|
||||
- Use only the first component of VERSION from /etc/os-release (#2070249)
|
||||
- Don't run power-on self-tests on DSA (#2061325)
|
||||
|
||||
* Fri Feb 25 2022 Daiki Ueno <dueno@redhat.com> - 3.7.3-9
|
||||
- Stop using typeof keyword for tss2 function prototypes (#2057490)
|
||||
- Ensure allowlist API is called before priority string construction (#1975421)
|
||||
|
||||
* Thu Feb 24 2022 Daiki Ueno <dueno@redhat.com> - 3.7.3-8
|
||||
- Fix previous change for loading libtss2* (#2057490)
|
||||
|
||||
* Wed Feb 23 2022 Daiki Ueno <dueno@redhat.com> - 3.7.3-7
|
||||
- Increase GNUTLS_MAX_ALGORITHM_NUM for allowlisting (#2033220)
|
||||
- Ensure allowlisting API is called before priority string is constructed (#2042532)
|
||||
- Use dlopen for loading libtss2* to avoid OpenSSL dependency (#2057490)
|
||||
|
||||
* Tue Feb 22 2022 Daiki Ueno <dueno@redhat.com> - 3.7.3-6
|
||||
- Compile out GOST algorithm IDs (#1945292)
|
||||
|
||||
* Thu Feb 17 2022 Zoltan Fridrich <zfridric@redhat.com> - 3.7.3-5
|
||||
- Fix upstream testsuite in fips mode (#2051637)
|
||||
|
||||
* Wed Feb 16 2022 Daiki Ueno <dueno@redhat.com> - 3.7.3-4
|
||||
- Specify FIPS140-3 module name and version
|
||||
- fips: allow a few more primes in RSA key generation
|
||||
- fips: tighten PKCS#12 algorithm checks
|
||||
- Correct return value of KTLS stub API
|
||||
|
||||
* Tue Feb 15 2022 Zoltan Fridrich <zfridric@redhat.com> - 3.7.3-3
|
||||
- Disable config reload in order to not break allowlisting (#2042532)
|
||||
|
||||
* Wed Feb 2 2022 Daiki Ueno <dueno@redhat.com> - 3.7.3-2
|
||||
- Build with TPM2 support, patch from Alexander Sosedkin (#2033220)
|
||||
|
||||
* Tue Jan 18 2022 Daiki Ueno <dueno@redhat.com> - 3.7.3-1
|
||||
- Update to gnutls 3.7.3 (#2033220)
|
||||
|
||||
* Wed Dec 22 2021 Daiki Ueno <dueno@redhat.com> - 3.7.2-10
|
||||
- Update gnutls_{hash,hmac}_copy man-pages as well (#1999639)
|
||||
|
||||
* Wed Dec 22 2021 Daiki Ueno <dueno@redhat.com> - 3.7.2-9
|
||||
- Drop support for GNUTLS_NO_EXPLICIT_INIT envvar in favor of
|
||||
GNUTLS_NO_IMPLICIT_INIT (#1999639)
|
||||
- Expand documentation of gnutls_{hash,hmac}_copy, mentioning that
|
||||
those do not always work (#1999639)
|
||||
|
||||
* Tue Dec 21 2021 Daiki Ueno <dueno@redhat.com> - 3.7.2-9
|
||||
- Fix race condition when resolving SYSTEM priority in allowlisting mode (#2012249)
|
||||
|
||||
* Thu Oct 21 2021 Daiki Ueno <dueno@redhat.com> - 3.7.2-8
|
||||
- Fix issues in bundled libopts, spotted by covscan (#1938730)
|
||||
|
||||
* Tue Oct 12 2021 Daiki Ueno <dueno@redhat.com> - 3.7.2-7
|
||||
- Enable Intel CET
|
||||
- Remove unnecessary CCASFLAGS setting for annocheck
|
||||
|
||||
* Thu Aug 19 2021 Daiki Ueno <dueno@redhat.com> - 3.7.2-6
|
||||
- Reorder doc/invoke-*.texi generation (#1975482)
|
||||
- Temporarily disable LTO for aarch64 and ppc64le
|
||||
|
||||
* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 3.7.2-5
|
||||
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
|
||||
Related: rhbz#1991688
|
||||
|
||||
* Mon Aug 2 2021 Daiki Ueno <dueno@redhat.com> - 3.7.2-4
|
||||
- Disable GOST cryptography by default (#1945292)
|
||||
- Tighten timestamp adjustment when not bootstrapping (#1975482)
|
||||
- Re-enable LTO (#1986143)
|
||||
|
||||
* Mon Jun 28 2021 Daiki Ueno <dueno@redhat.com> - 3.7.2-3
|
||||
- Enable allowlisting configuration mode (#1975421)
|
||||
|
||||
* Sat Jun 26 2021 Daiki Ueno <dueno@redhat.com> - 3.7.2-2
|
||||
- Remove %%defattr invocations which are no longer necessary
|
||||
- libpkcs11mock1.* is not installed anymore
|
||||
- hobble-gnutls: Remove SRP removal
|
||||
- Use correct source URL
|
||||
- Switch to using %%gpgverify macro
|
||||
|
||||
* Fri Jun 25 2021 Daiki Ueno <dueno@redhat.com> - 3.7.2-1
|
||||
- Update to upstream 3.7.2 release (#1966479)
|
||||
|
||||
* Tue Jun 22 2021 Mohan Boddu <mboddu@redhat.com> - 3.7.1-6
|
||||
- Rebuilt for RHEL 9 BETA for openssl 3.0
|
||||
Related: rhbz#1971065
|
||||
|
||||
* Thu Jun 3 2021 Daiki Ueno <dueno@redhat.com> - 3.7.1-5
|
||||
- Fix typo in TPM 1.2 disablement (#1927370)
|
||||
|
||||
* Thu May 27 2021 Daiki Ueno <dueno@redhat.com> - 3.7.1-4
|
||||
- Disable TPM support by default (#1927370)
|
||||
|
||||
* Thu Apr 15 2021 Mohan Boddu <mboddu@redhat.com> - 3.7.1-3
|
||||
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
|
||||
|
||||
* Tue Mar 16 2021 Daiki Ueno <dueno@redhat.com> - 3.7.1-2
|
||||
- Restore fipscheck dependency
|
||||
|
||||
* Sat Mar 13 2021 Daiki Ueno <dueno@redhat.com> - 3.7.1-1
|
||||
- Update to upstream 3.7.1 release
|
||||
- Remove fipscheck dependency, as it is now calculated with an
|
||||
internal tool
|
||||
|
||||
* Fri Mar 5 2021 Daiki Ueno <dueno@redhat.com> - 3.7.0-4
|
||||
- Tolerate duplicate certs in the chain also with PKCS #11 trust store
|
||||
|
||||
* Tue Mar 2 2021 Daiki Ueno <dueno@redhat.com> - 3.7.0-3
|
||||
- Reduce BRs for non-bootstrapping build
|
||||
|
||||
* Wed Feb 10 2021 Daiki Ueno <dueno@redhat.com> - 3.7.0-2
|
||||
- Tolerate duplicate certs in the chain
|
||||
|
||||
* Mon Feb 8 2021 Daiki Ueno <dueno@redhat.com> - 3.7.0-1
|
||||
- Update to upstream 3.7.0 release
|
||||
- Temporarily disable LTO
|
||||
|
||||
* Tue Jan 26 2021 Daiki Ueno <dueno@redhat.com> - 3.6.15-4
|
||||
- Fix broken tests on rawhide (#1908110)
|
||||
- Add BuildRequires: make (by Tom Stellard)
|
||||
|
||||
* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.15-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
|
||||
|
||||
* Mon Sep 28 2020 Jeff Law <law@redhat.com> - 3.6.15-2
|
||||
- Re-enable LTO now that upstream GCC bugs have been fixed
|
||||
|
||||
* Fri Sep 4 2020 Daiki Ueno <dueno@redhat.com> - 3.6.15-1
|
||||
- Update to upstream 3.6.15 release
|
||||
|
||||
* Mon Aug 17 2020 Jeff Law <law@redhat.com> - 3.6.14-7
|
||||
- Disable LTO on ppc64le
|
||||
|
||||
* Tue Aug 4 2020 Daiki Ueno <dueno@redhat.com> - 3.6.14-6
|
||||
- Fix underlinking of libpthread
|
||||
|
||||
* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.14-5
|
||||
- Second attempt - Rebuilt for
|
||||
https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
|
||||
|
||||
* Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.14-4
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
|
||||
|
||||
* Thu Jul 02 2020 Anderson Sasaki <ansasaki@redhat.com> - 3.6.14-3
|
||||
- Rebuild with autogen built with guile-2.2 (#1852706)
|
||||
|
||||
* Tue Jun 09 2020 Anderson Sasaki <ansasaki@redhat.com> - 3.6.14-2
|
||||
- Fix memory leak when serializing iovec_t (#1845083)
|
||||
- Fix automatic libraries sonames detection (#1845806)
|
||||
* Thu Jun 4 2020 Daiki Ueno <dueno@redhat.com> - 3.6.14-2
|
||||
- Return false from gnutls_fips140_mode_enabled() if selftests failed (#1827687)
|
||||
|
||||
* Thu Jun 4 2020 Daiki Ueno <dueno@redhat.com> - 3.6.14-1
|
||||
- Update to upstream 3.6.14 release
|
||||
|
||||
* Sun May 31 2020 Daiki Ueno <dueno@redhat.com> - 3.6.13-6
|
||||
- Update gnutls-3.6.13-superseding-chain.patch
|
||||
* Mon May 25 2020 Anderson Sasaki <ansasaki@redhat.com> - 3.6.13-3
|
||||
- Add an option to gnutls-cli to wait for resumption under TLS 1.3 (#1677754)
|
||||
|
||||
* Sun May 31 2020 Daiki Ueno <dueno@redhat.com> - 3.6.13-5
|
||||
- Fix cert chain validation behavior if the last cert has expired (#1842178)
|
||||
* Wed May 20 2020 Anderson Sasaki <ansasaki@redhat.com> - 3.6.13-2
|
||||
- Enable Intel CET (#1838476)
|
||||
|
||||
* Mon May 25 2020 Anderson Sasaki <ansasaki@redhat.com> - 3.6.13-4
|
||||
- Add option to gnutls-cli to wait for resumption under TLS 1.3
|
||||
|
||||
* Tue May 19 2020 Anderson Sasaki <ansasaki@redhat.com> - 3.6.13-3
|
||||
- Disable RSA blinding during FIPS self-tests
|
||||
|
||||
* Thu May 14 2020 Anderson Sasaki <ansasaki@redhat.com> - 3.6.13-2
|
||||
- Bump linked libraries soname to fix FIPS selftests (#1835265)
|
||||
|
||||
* Tue Mar 31 2020 Daiki Ueno <dueno@redhat.com> - 3.6.13-1
|
||||
* Tue May 5 2020 Daiki Ueno <dueno@redhat.com> - 3.6.13-1
|
||||
- Update to upstream 3.6.13 release
|
||||
|
||||
* Thu Mar 26 2020 Anderson Sasaki <ansasaki@redhat.com> - 3.6.12-2
|
||||
- Fix FIPS POST (#1813384)
|
||||
- Fix gnutls-serv --echo to not exit when a message is received (#1816583)
|
||||
* Tue Apr 21 2020 Daiki Ueno <dueno@redhat.com> - 3.6.8-10
|
||||
- Fix CVE-2020-11501 (#1822005)
|
||||
|
||||
* Sun Feb 02 2020 Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com> - 3.6.12-1
|
||||
- Update to upstream 3.6.12 release
|
||||
* Wed Nov 6 2019 Daiki Ueno <dueno@redhat.com> - 3.6.8-9
|
||||
- Fix CFB8 decryption when repeatedly called (#1757848)
|
||||
- Fix gnutls_aead_cipher_{en,de}cryptv2 with input not multiple of block size (#1757856)
|
||||
|
||||
* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.11-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
|
||||
* Fri Aug 16 2019 Daiki Ueno <dueno@redhat.com> - 3.6.8-8
|
||||
- Use fallback random function for RSA blinding in FIPS selftests
|
||||
|
||||
* Mon Dec 02 2019 Nikos Mavrogiannopoulos <nmav@gnutls.org> - 3.6.11-1
|
||||
- Update to upstream 3.6.11 release
|
||||
* Fri Aug 16 2019 Daiki Ueno <dueno@redhat.com> - 3.6.8-7
|
||||
- Fix deterministic signature creation in selftests
|
||||
|
||||
* Sun Sep 29 2019 Nikos Mavrogiannopoulos <nmav@gnutls.org> - 3.6.10-1
|
||||
- Update to upstream 3.6.10 release
|
||||
* Fri Aug 16 2019 Daiki Ueno <dueno@redhat.com> - 3.6.8-6
|
||||
- Treat login error more gracefully when enumerating PKCS#11 tokens (#1705478)
|
||||
- Use deterministic ECDSA/DSA in FIPS selftests (#1716560)
|
||||
- Add gnutls_aead_cipher_{encrypt,decrypt}v2 functions (#1684461)
|
||||
|
||||
* Fri Jul 26 2019 Nikos Mavrogiannopoulos <nmav@gnutls.org> - 3.6.9-1
|
||||
- Update to upstream 3.6.9 release
|
||||
* Fri Aug 9 2019 Daiki Ueno <dueno@redhat.com> - 3.6.8-5
|
||||
- Avoid UB when encrypting session tickets
|
||||
|
||||
* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.8-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
|
||||
* Tue Jul 2 2019 Daiki Ueno <dueno@redhat.com> - 3.6.8-4
|
||||
- Add RNG continuous test under FIPS
|
||||
|
||||
* Mon Jul 15 2019 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.8-2
|
||||
- Rebuilt with guile-2.2
|
||||
* Fri Jun 14 2019 Daiki Ueno <dueno@redhat.com> - 3.6.8-3
|
||||
- Follow-up fix on multiple key updates handling (#1673975)
|
||||
|
||||
* Tue May 28 2019 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.8-1
|
||||
* Thu Jun 13 2019 Daiki Ueno <dueno@redhat.com> - 3.6.8-2
|
||||
- Run FIPS AES self-tests over overridden algorithms
|
||||
|
||||
* Wed May 29 2019 Daiki Ueno <dueno@redhat.com> - 3.6.8-1
|
||||
- Update to upstream 3.6.8 release
|
||||
|
||||
* Wed Mar 27 2019 Anderson Toshiyuki Sasaki <ansasaki@redhat.com> - 3.6.7-1
|
||||
- Update to upstream 3.6.7 release
|
||||
- Fixed CVE-2019-3836 (#1693214)
|
||||
- Fixed CVE-2019-3829 (#1693210)
|
||||
* Fri May 24 2019 Anderson Sasaki <ansasaki@redhat.com> - 3.6.5-4
|
||||
- Fixed FIPS signatures self tests (#1680509)
|
||||
|
||||
* Fri Feb 1 2019 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.6-1
|
||||
- Update to upstream 3.6.6 release
|
||||
* Wed Mar 27 2019 Anderson Sasaki <ansasaki@redhat.com> - 3.6.5-3
|
||||
- Fixed CVE-2019-3829 (#1693285)
|
||||
- Fixed CVE-2019-3836 (#1693288)
|
||||
- Added explicit BuildRequires for nettle-devel >= 3.4.1
|
||||
|
||||
* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.5-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
|
||||
* Fri Jan 11 2019 Anderson Sasaki <ansasaki@redhat.com> - 3.6.5-2
|
||||
- Fixed FIPS integrity self tests (#1665061)
|
||||
|
||||
* Fri Jan 11 2019 Anderson Toshiyuki Sasaki <ansasaki@redhat.com> - 3.6.5-2
|
||||
* Mon Dec 17 2018 Anderson Sasaki <ansasaki@redhat.com> - 3.6.5-1
|
||||
- Update to upstream 3.6.5 release
|
||||
- Fixes CVE-2018-16868 (#1655395)
|
||||
- Removed ldconfig scriptlet
|
||||
- Added explicit Requires for nettle >= 3.4.1
|
||||
|
||||
* Tue Dec 11 2018 Anderson Toshiyuki Sasaki <ansasaki@redhat.com> - 3.6.5-1
|
||||
- Update to upstream 3.6.5 release
|
||||
* Mon Nov 26 2018 Anderson Sasaki <ansasaki@redhat.com> - 3.6.4-7
|
||||
- Fix incorrect certificate type returned in TLS1.3 resumption (#1649786)
|
||||
|
||||
* Mon Oct 29 2018 James Antill <james.antill@redhat.com> - 3.6.4-5
|
||||
- Remove ldconfig scriptlet, now done via. transfiletrigger in glibc.
|
||||
* Mon Nov 12 2018 Anderson Sasaki <ansasaki@redhat.com> - 3.6.4-6
|
||||
- Add support for record_size_limit extension in TLS1.2 (#1644850)
|
||||
|
||||
* Wed Oct 17 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.4-4
|
||||
- Fix issue with rehandshake affecting glib-networking (#1634736)
|
||||
* Tue Oct 30 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.4-5
|
||||
- Fix issue with GOST ciphers (#1644193)
|
||||
- Made gnutls-serv use the default priorities if none is specified (#1644243)
|
||||
|
||||
* Tue Oct 16 2018 Tomáš Mráz <tmraz@redhat.com> - 3.6.4-3
|
||||
* Wed Oct 24 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.4-3
|
||||
- Fix issue with rehandshake affecting glib-networking (#1641072)
|
||||
|
||||
* Tue Oct 16 2018 Tomáš Mráz <tmraz@redhat.com> - 3.6.4-2
|
||||
- Add missing annobin notes for assembler sources
|
||||
|
||||
* Tue Oct 09 2018 Petr Menšík <pemensik@redhat.com> - 3.6.4-2
|
||||
- Rebuilt for unbound 1.8
|
||||
|
||||
* Tue Sep 25 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.4-1
|
||||
- Updated to upstream 3.6.4 release
|
||||
- Added support for the latest version of the TLS1.3 protocol
|
||||
- Enabled SHA1 support as SHA1 deprecation is handled via the
|
||||
fedora crypto policies.
|
||||
|
||||
* Thu Aug 16 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.3-4
|
||||
- Fixed gnutls-cli input reading
|
||||
- Fixed support for ECDSA public keys (backported from Fedora)
|
||||
- Ensure that we do not cause issues with version rollback detection
|
||||
and TLS1.3.
|
||||
|
||||
* Tue Aug 07 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.3-3
|
||||
- Fixed ECDSA public key import (#1612803)
|
||||
|
||||
* Thu Jul 26 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.3-2
|
||||
- Backported regression fixes from 3.6.2
|
||||
|
||||
* Mon Jul 16 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.3-1
|
||||
- Update to upstream 3.6.3 release
|
||||
|
||||
* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.2-5
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
|
||||
|
||||
* Wed Jun 13 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.2-4
|
||||
- Enable FIPS140-2 mode in Fedora
|
||||
* Thu Jul 26 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.3-4
|
||||
- Updated to upstream 3.6.3 release
|
||||
|
||||
* Wed Jun 06 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.2-3
|
||||
- Update to upstream 3.6.2 release
|
||||
|
||||
* Fri May 25 2018 David Abdurachmanov <david.abdurachmanov@gmail.com> - 3.6.2-2
|
||||
- Include FIPS mode
|
||||
- Add missing BuildRequires: gnupg2 for gpgv2 in %%prep
|
||||
|
||||
* Fri Feb 16 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.2-1
|
||||
- Update to upstream 3.6.2 release
|
||||
- Updated to upstream 3.6.2 release
|
||||
|
||||
* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.1-5
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
|
||||
|
|
Loading…
Reference in New Issue