Skip to content

Commit c1fa9ed

Browse files
padelsbachpadelsbach
authored
Merge pull request #236 from BridgerVoss/bug_fix
disables MD5 on FIPS builds and adds WP_ALLOW_NON_FIPS flag
2 parents 7829bea + 008f448 commit c1fa9ed

File tree

3 files changed

+62
-8
lines changed

3 files changed

+62
-8
lines changed

‎src/wp_des.c‎

Lines changed: 29 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@
3131

3232

3333
#if defined(WP_HAVE_DES3CBC)
34-
34+
#if !defined(HAVE_FIPS) || defined(WP_ALLOW_NON_FIPS)
3535
/**
3636
* Data structure for DES3 ciphers that are block based.
3737
*/
@@ -283,7 +283,6 @@ static int wp_des3_block_init(wp_Des3BlockCtx *ctx, const unsigned char *key,
283283
if (!wolfssl_prov_is_running()) {
284284
ok = 0;
285285
}
286-
287286
if (ok && (iv != NULL) && (ctx->mode != EVP_CIPH_ECB_MODE) &&
288287
(!wp_des3_init_iv(ctx, iv, ivLen))) {
289288
ok = 0;
@@ -866,6 +865,33 @@ IMPLEMENT_DES3_BLOCK_DISPATCH(lcmode, kBits, ivBits)
866865
/** wp_des3cbc_functions_functions */
867866
IMPLEMENT_DES3_BLOCK(cbc, CBC, 192, 64)
868867

868+
#else /* defined(HAVE_FIPS) && !defined(WP_ALLOW_NON_FIPS */
869+
870+
#define IMPLEMENT_DES3_BLOCK_NULL(mode) \
871+
const OSSL_DISPATCH wp_des3##mode##_functions[] = { \
872+
{ OSSL_FUNC_CIPHER_NEWCTX, (DFUNC)wp_des3_null }, \
873+
{ OSSL_FUNC_CIPHER_FREECTX, (DFUNC)wp_des3_void }, \
874+
{ OSSL_FUNC_CIPHER_DUPCTX, (DFUNC)wp_des3_null }, \
875+
{ OSSL_FUNC_CIPHER_ENCRYPT_INIT, (DFUNC)wp_des3_null }, \
876+
{ OSSL_FUNC_CIPHER_DECRYPT_INIT, (DFUNC)wp_des3_null }, \
877+
{ OSSL_FUNC_CIPHER_UPDATE, (DFUNC)wp_des3_null }, \
878+
{ OSSL_FUNC_CIPHER_FINAL, (DFUNC)wp_des3_null }, \
879+
{ OSSL_FUNC_CIPHER_CIPHER, (DFUNC)wp_des3_null }, \
880+
{ OSSL_FUNC_CIPHER_GET_PARAMS, (DFUNC)wp_des3_null }, \
881+
{ OSSL_FUNC_CIPHER_GET_CTX_PARAMS, (DFUNC)wp_des3_null }, \
882+
{ OSSL_FUNC_CIPHER_SET_CTX_PARAMS, (DFUNC)wp_des3_null }, \
883+
{ OSSL_FUNC_CIPHER_GETTABLE_PARAMS, (DFUNC)wp_des3_null }, \
884+
{ OSSL_FUNC_CIPHER_GETTABLE_CTX_PARAMS, \
885+
(DFUNC)wp_des3_null }, \
886+
{ OSSL_FUNC_CIPHER_SETTABLE_CTX_PARAMS, \
887+
(DFUNC)wp_des3_null }, \
888+
{ 0, NULL } \
889+
};
890+
static int wp_des3_null(void) { return 0; }
891+
static void wp_des3_void(void) {}
892+
893+
IMPLEMENT_DES3_BLOCK_NULL(cbc)
869894

870-
#endif /* WP_HAVE_AESCBC || WP_HAVE_AESECB */
895+
#endif
896+
#endif /* WP_HAVE_DES3CBC */
871897

‎src/wp_digests.c‎

Lines changed: 26 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -220,6 +220,24 @@ const OSSL_DISPATCH name##_functions[] = { \
220220
{ 0, NULL } \
221221
};
222222

223+
#if defined(HAVE_FIPS) && !defined(WP_ALLOW_NON_FIPS)
224+
#define IMPLEMENT_DIGEST_NULL(name) \
225+
/** Dispatch table for digest algorithms. */ \
226+
const OSSL_DISPATCH name##_functions[] = { \
227+
{ OSSL_FUNC_DIGEST_NEWCTX, (DFUNC)wp_digest_null }, \
228+
{ OSSL_FUNC_DIGEST_INIT, (DFUNC)wp_digest_null }, \
229+
{ OSSL_FUNC_DIGEST_UPDATE, (DFUNC)wp_digest_null }, \
230+
{ OSSL_FUNC_DIGEST_FINAL, (DFUNC)wp_digest_null }, \
231+
{ OSSL_FUNC_DIGEST_FREECTX, (DFUNC)wp_digest_void }, \
232+
{ OSSL_FUNC_DIGEST_DUPCTX, (DFUNC)wp_digest_null }, \
233+
{ OSSL_FUNC_DIGEST_GET_PARAMS, (DFUNC)wp_digest_null }, \
234+
{ OSSL_FUNC_DIGEST_GETTABLE_PARAMS, (DFUNC)wp_digest_null }, \
235+
{ 0, NULL } \
236+
};
237+
238+
static int wp_digest_null(void) { return 0; }
239+
static void wp_digest_void(void) {}
240+
#endif
223241

224242
/**
225243
* Get parameters of a digest algorithm.
@@ -292,18 +310,23 @@ static const OSSL_PARAM* wp_digest_gettable_params(void* provCtx)
292310
******************************************************************************/
293311

294312
#ifdef WP_HAVE_MD5
313+
#if defined(HAVE_FIPS) && !defined(WP_ALLOW_NON_FIPS)
314+
IMPLEMENT_DIGEST_NULL(wp_md5)
315+
#else
295316
IMPLEMENT_DIGEST(wp_md5, wc_Md5,
296317
WC_MD5_BLOCK_SIZE, WC_MD5_DIGEST_SIZE,
297318
0,
298319
wc_InitMd5_ex, wc_Md5Update, wc_Md5Final,
299320
wc_Md5Copy, wc_Md5Free)
300321
#endif
322+
#endif
301323

302324
/*******************************************************************************
303325
* SHA1-MD5
304326
******************************************************************************/
305327

306328
#ifdef WP_HAVE_MD5_SHA1
329+
#if !defined(HAVE_FIPS) || defined(WP_ALLOW_NON_FIPS)
307330
/**
308331
* Combined MD5 and SHA-1 digest.
309332
*/
@@ -326,7 +349,6 @@ typedef struct wp_Md5Sha {
326349
static int wp_InitMd5Sha_ex(wp_Md5Sha* dgst, void* heap, int devId)
327350
{
328351
int rc;
329-
330352
rc = wc_InitMd5_ex(&dgst->md5, heap, devId);
331353
if (rc == 0) {
332354
rc = wc_InitSha_ex(&dgst->sha, heap, devId);
@@ -411,12 +433,14 @@ static void wp_Md5ShaFree(wp_Md5Sha* d)
411433
wc_ShaFree(&d->sha);
412434
}
413435
}
414-
415436
IMPLEMENT_DIGEST(wp_md5_sha1, wp_Md5Sha,
416437
WC_MD5_BLOCK_SIZE, WC_MD5_DIGEST_SIZE + WC_SHA_DIGEST_SIZE,
417438
0,
418439
wp_InitMd5Sha_ex, wp_Md5ShaUpdate, wp_Md5ShaFinal,
419440
wp_Md5ShaCopy, wp_Md5ShaFree)
441+
#else /* defined(HAVE_FIPS) && !defined(WP_ALLOW_NON_FIPS) */
442+
IMPLEMENT_DIGEST_NULL(wp_md5_sha1)
443+
#endif
420444
#endif
421445

422446
/*******************************************************************************

‎test/unit.c‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -106,8 +106,10 @@ TEST_CASE test_case[] = {
106106
TEST_DECL(test_krb5kdf, NULL),
107107
#endif
108108
#ifdef WP_HAVE_DES3CBC
109-
TEST_DECL(test_des3_cbc, NULL),
110-
TEST_DECL(test_des3_cbc_stream, NULL),
109+
#if !defined(HAVE_FIPS) || defined(WP_ALLOW_NON_FIPS)
110+
TEST_DECL(test_des3_cbc, NULL),
111+
TEST_DECL(test_des3_cbc_stream, NULL),
112+
#endif
111113
#endif
112114
#ifdef WP_HAVE_AESECB
113115
TEST_DECL(test_aes128_ecb, NULL),
@@ -296,7 +298,9 @@ TEST_CASE test_case[] = {
296298
#endif /* WP_HAVE_ECDSA */
297299

298300
#ifdef WP_HAVE_PBE
299-
TEST_DECL(test_pbe, NULL),
301+
#if !defined(HAVE_FIPS) || defined(WP_ALLOW_NON_FIPS)
302+
TEST_DECL(test_pbe, NULL),
303+
#endif
300304
#endif
301305

302306
#if defined(WP_HAVE_ED25519) || defined(WP_HAVE_ED448)

0 commit comments

Comments
 (0)