File 1636-crypto-Change-and-simplify-the-FIPS-mode-r... of Package erlang

Overview Repositories Revisions Requests Users Attributes Meta

File 1636-crypto-Change-and-simplify-the-FIPS-mode-related-mac.patch of Package erlang (Revision 740810ae07adffc1a50bb3a32135aa98)

Currently displaying revision 740810ae07adffc1a50bb3a32135aa98 , Show latest

From f6ed9faebc83df8123064a6cc210b2ab147b84ff Mon Sep 17 00:00:00 2001
From: Hans Nilsson <hans@erlang.org>
Date: Fri, 29 May 2020 08:31:30 +0200
Subject: [PATCH 06/17] crypto: Change (and simplify) the FIPS mode related
 macros

as a preparation for the 3.0 adaption.
---
 lib/crypto/c_src/algorithms.c     | 27 ++++++++-------------------
 lib/crypto/c_src/atoms.c          |  7 +------
 lib/crypto/c_src/atoms.h          |  3 ---
 lib/crypto/c_src/cipher.h         |  5 +----
 lib/crypto/c_src/digest.h         |  4 +---
 lib/crypto/c_src/fips.c           |  2 +-
 lib/crypto/c_src/mac.c            |  6 +-----
 lib/crypto/c_src/openssl_config.h |  9 +++++----
 lib/crypto/c_src/pkey.c           | 10 +++++-----
 lib/crypto/c_src/srp.c            |  6 +++---
 10 files changed, 26 insertions(+), 53 deletions(-)

diff --git a/lib/crypto/c_src/algorithms.c b/lib/crypto/c_src/algorithms.c
index 4de595a934..e7087bd461 100644
--- a/lib/crypto/c_src/algorithms.c
+++ b/lib/crypto/c_src/algorithms.c
@@ -65,10 +65,7 @@ void cleanup_algorithms_types(ErlNifEnv* env)
 ERL_NIF_TERM hash_algorithms(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
 {
     unsigned int cnt  =
-#ifdef FIPS_SUPPORT
-        FIPS_mode() ? algo_hash_fips_cnt :
-#endif
-        algo_hash_cnt;
+        FIPS_MODE() ? algo_hash_fips_cnt : algo_hash_cnt;
 
     return enif_make_list_from_array(env, algo_hash, cnt);
 }
@@ -129,10 +126,7 @@ void init_hash_types(ErlNifEnv* env) {
 ERL_NIF_TERM pubkey_algorithms(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
 {
     unsigned int cnt  =
-#ifdef FIPS_SUPPORT
-        FIPS_mode() ? algo_pubkey_fips_cnt :
-#endif
-        algo_pubkey_cnt;
+        FIPS_MODE() ? algo_pubkey_fips_cnt : algo_pubkey_cnt;
 
     return enif_make_list_from_array(env, algo_pubkey, cnt);
 }
@@ -195,14 +189,12 @@ ERL_NIF_TERM mac_algorithms(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
 
 ERL_NIF_TERM curve_algorithms(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
 {
-    int fips_mode = 0;
-    int algo_curve_cnt = 0;
-
-# ifdef FIPS_SUPPORT
-    if (FIPS_mode()) fips_mode = 1;
-# endif
+    int fips_mode;
+    int algo_curve_cnt;
 
+    fips_mode = FIPS_MODE();
     algo_curve_cnt = get_curve_cnt(env, fips_mode);
+
     return enif_make_list_from_array(env, algo_curve[fips_mode], algo_curve_cnt);
 }
 
@@ -247,7 +239,7 @@ void init_curve_types(ErlNifEnv* env) {
        by calling get_curve_cnt
     */
 #ifdef FIPS_SUPPORT
-    if (FIPS_mode()) {
+    if (FIPS_MODE()) {
         // FIPS enabled
         get_curve_cnt(env, 1);
         FIPS_mode_set(0); // disable
@@ -695,10 +687,7 @@ int valid_curve(int nid) {
 ERL_NIF_TERM rsa_opts_algorithms(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
 {
     unsigned int cnt  =
-#ifdef FIPS_SUPPORT
-        FIPS_mode() ? algo_rsa_opts_fips_cnt :
-#endif
-        algo_rsa_opts_cnt;
+        FIPS_MODE() ? algo_rsa_opts_fips_cnt : algo_rsa_opts_cnt;
 
     return enif_make_list_from_array(env, algo_rsa_opts, cnt);
 }
diff --git a/lib/crypto/c_src/atoms.c b/lib/crypto/c_src/atoms.c
index cae3c5287d..b6a190bf09 100644
--- a/lib/crypto/c_src/atoms.c
+++ b/lib/crypto/c_src/atoms.c
@@ -44,12 +44,9 @@ ERL_NIF_TERM atom_none;
 ERL_NIF_TERM atom_notsup;
 ERL_NIF_TERM atom_badarg;
 ERL_NIF_TERM atom_digest;
-#ifdef FIPS_SUPPORT
 ERL_NIF_TERM atom_enabled;
 ERL_NIF_TERM atom_not_enabled;
-#else
 ERL_NIF_TERM atom_not_supported;
-#endif
 
 ERL_NIF_TERM atom_type;
 ERL_NIF_TERM atom_size;
@@ -230,12 +227,10 @@ int init_atoms(ErlNifEnv *env, const ERL_NIF_TERM fips_mode, const ERL_NIF_TERM
     atom_aes_ccm = enif_make_atom(env, "aes_ccm");
 #endif
 
-#ifdef FIPS_SUPPORT
     atom_enabled = enif_make_atom(env,"enabled");
     atom_not_enabled = enif_make_atom(env,"not_enabled");
-#else
     atom_not_supported = enif_make_atom(env,"not_supported");
-#endif
+
     atom_rsa = enif_make_atom(env,"rsa");
     atom_dss = enif_make_atom(env,"dss");
     atom_ecdsa = enif_make_atom(env,"ecdsa");
diff --git a/lib/crypto/c_src/atoms.h b/lib/crypto/c_src/atoms.h
index d6bdc43a52..7bedf799b6 100644
--- a/lib/crypto/c_src/atoms.h
+++ b/lib/crypto/c_src/atoms.h
@@ -48,12 +48,9 @@ extern ERL_NIF_TERM atom_none;
 extern ERL_NIF_TERM atom_notsup;
 extern ERL_NIF_TERM atom_badarg;
 extern ERL_NIF_TERM atom_digest;
-#ifdef FIPS_SUPPORT
 extern ERL_NIF_TERM atom_enabled;
 extern ERL_NIF_TERM atom_not_enabled;
-#else
 extern ERL_NIF_TERM atom_not_supported;
-#endif
 
 extern ERL_NIF_TERM atom_type;
 extern ERL_NIF_TERM atom_size;
diff --git a/lib/crypto/c_src/cipher.h b/lib/crypto/c_src/cipher.h
index d4c1bed98d..0189e4416b 100644
--- a/lib/crypto/c_src/cipher.h
+++ b/lib/crypto/c_src/cipher.h
@@ -49,12 +49,9 @@ struct cipher_type_t {
 #define CCM_MODE 64
 #define GCM_MODE 128
 
-
 #ifdef FIPS_SUPPORT
-/* May have FIPS support, must check dynamically if it is enabled */
-# define CIPHER_FORBIDDEN_IN_FIPS(P) (((P)->flags & NO_FIPS_CIPHER) && FIPS_mode())
+# define CIPHER_FORBIDDEN_IN_FIPS(P) (((P)->flags & NO_FIPS_CIPHER) && FIPS_MODE())
 #else
-/* No FIPS support since the symbol FIPS_SUPPORT is undefined */
 # define CIPHER_FORBIDDEN_IN_FIPS(P) 0
 #endif
 
diff --git a/lib/crypto/c_src/digest.h b/lib/crypto/c_src/digest.h
index 76fe14a06a..a1cfb4d4cb 100644
--- a/lib/crypto/c_src/digest.h
+++ b/lib/crypto/c_src/digest.h
@@ -39,10 +39,8 @@ struct digest_type_t {
 #define NO_FIPS_DIGEST 1
 
 #ifdef FIPS_SUPPORT
-/* May have FIPS support, must check dynamically if it is enabled */
-# define DIGEST_FORBIDDEN_IN_FIPS(P) (((P)->flags & NO_FIPS_DIGEST) && FIPS_mode())
+# define DIGEST_FORBIDDEN_IN_FIPS(P) (((P)->flags & NO_FIPS_DIGEST) && FIPS_MODE())
 #else
-/* No FIPS support since the symbol FIPS_SUPPORT is undefined */
 # define DIGEST_FORBIDDEN_IN_FIPS(P) 0
 #endif
 
diff --git a/lib/crypto/c_src/fips.c b/lib/crypto/c_src/fips.c
index 072aade7b9..046169ad8d 100644
--- a/lib/crypto/c_src/fips.c
+++ b/lib/crypto/c_src/fips.c
@@ -23,7 +23,7 @@
 ERL_NIF_TERM info_fips(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
 {
 #ifdef FIPS_SUPPORT
-    return FIPS_mode() ? atom_enabled : atom_not_enabled;
+    return FIPS_MODE() ? atom_enabled : atom_not_enabled;
 #else
     return atom_not_supported;
 #endif
diff --git a/lib/crypto/c_src/mac.c b/lib/crypto/c_src/mac.c
index 13bd2815b1..747d5c7f39 100644
--- a/lib/crypto/c_src/mac.c
+++ b/lib/crypto/c_src/mac.c
@@ -85,16 +85,12 @@ static struct mac_type_t mac_types[] =
     }
 };
 
-
 #ifdef FIPS_SUPPORT
-/* May have FIPS support, must check dynamically if it is enabled */
-# define MAC_FORBIDDEN_IN_FIPS(P) (((P)->flags & NO_FIPS_MAC) && FIPS_mode())
+# define MAC_FORBIDDEN_IN_FIPS(P) (((P)->flags & NO_FIPS_MAC) && FIPS_MODE())
 #else
-/* No FIPS support since the symbol FIPS_SUPPORT is undefined */
 # define MAC_FORBIDDEN_IN_FIPS(P) 0
 #endif
 
-
 /***************************
  Mandatory prototypes
 ***************************/
diff --git a/lib/crypto/c_src/openssl_config.h b/lib/crypto/c_src/openssl_config.h
index 64cfeda594..8fbb1f959c 100644
--- a/lib/crypto/c_src/openssl_config.h
+++ b/lib/crypto/c_src/openssl_config.h
@@ -421,11 +421,12 @@ do {                                                    \
 #endif
 
 
-#ifdef FIPS_SUPPORT
-/* In FIPS mode non-FIPS algorithms are disabled and return badarg. */
-#define CHECK_NO_FIPS_MODE() { if (FIPS_mode()) return atom_notsup; }
+#if defined(FIPS_SUPPORT)
+# define FIPS_MODE() (FIPS_mode() ? 1 : 0)
 #else
-#define CHECK_NO_FIPS_MODE()
+# define FIPS_MODE() 0
 #endif
 
+
+
 #endif /* E_OPENSSL_CONFIG_H__ */
diff --git a/lib/crypto/c_src/pkey.c b/lib/crypto/c_src/pkey.c
index 1824a08fb9..2c2fbc9a15 100644
--- a/lib/crypto/c_src/pkey.c
+++ b/lib/crypto/c_src/pkey.c
@@ -73,7 +73,7 @@ static int get_pkey_digest_type(ErlNifEnv *env, ERL_NIF_TERM algorithm, ERL_NIF_
         return PKEY_OK;
     if (algorithm == atom_eddsa) {
 #ifdef HAVE_EDDSA
-        if (!FIPS_mode()) return PKEY_OK;
+        if (!FIPS_MODE()) return PKEY_OK;
 #else
         return PKEY_NOTSUP;
 #endif
@@ -322,7 +322,7 @@ static int get_pkey_private_key(ErlNifEnv *env, ERL_NIF_TERM algorithm, ERL_NIF_
 
     } else if (algorithm == atom_eddsa) {
 #ifdef HAVE_EDDSA
-        if (FIPS_mode())
+        if (FIPS_MODE())
             return PKEY_NOTSUP;
         if (!get_eddsa_key(env, 0, key, &result))
             goto err;
@@ -452,7 +452,7 @@ static int get_pkey_public_key(ErlNifEnv *env, ERL_NIF_TERM algorithm, ERL_NIF_T
 #endif
     } else if (algorithm == atom_eddsa) {
 #ifdef HAVE_EDDSA
-        if (!FIPS_mode()) {
+        if (!FIPS_MODE()) {
             if (!get_eddsa_key(env, 1, key, &result))
                 goto err;
         }
@@ -609,7 +609,7 @@ enif_get_atom(env,argv[1],buf,1024,ERL_NIF_LATIN1); printf("hash=%s ",buf);
 
     if (argv[0] == atom_eddsa) {
 #ifdef HAVE_EDDSA
-        if (!FIPS_mode()) {
+        if (!FIPS_MODE()) {
             if ((mdctx = EVP_MD_CTX_new()) == NULL)
                 goto err;
 
@@ -842,7 +842,7 @@ ERL_NIF_TERM pkey_verify_nif(ErlNifEnv *env, int argc, const ERL_NIF_TERM argv[]
 
     if (argv[0] == atom_eddsa) {
 #ifdef HAVE_EDDSA
-        if (!FIPS_mode()) {
+        if (!FIPS_MODE()) {
             if ((mdctx = EVP_MD_CTX_new()) == NULL)
                 goto err;
 
diff --git a/lib/crypto/c_src/srp.c b/lib/crypto/c_src/srp.c
index 22fbedb4eb..330c579d47 100644
--- a/lib/crypto/c_src/srp.c
+++ b/lib/crypto/c_src/srp.c
@@ -30,7 +30,7 @@ ERL_NIF_TERM srp_value_B_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]
     int dlen;
     ERL_NIF_TERM ret;
 
-    CHECK_NO_FIPS_MODE();
+    if (FIPS_MODE()) return atom_notsup;
 
     ASSERT(argc == 5);
 
@@ -122,7 +122,7 @@ ERL_NIF_TERM srp_user_secret_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM ar
     int dlen;
     ERL_NIF_TERM ret;
 
-    CHECK_NO_FIPS_MODE();
+    if (FIPS_MODE()) return atom_notsup;
 
     ASSERT(argc == 7);
 
@@ -232,7 +232,7 @@ ERL_NIF_TERM srp_host_secret_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM ar
     int dlen;
     ERL_NIF_TERM ret;
 
-    CHECK_NO_FIPS_MODE();
+    if (FIPS_MODE()) return atom_notsup;
 
     ASSERT(argc == 5);
 
-- 
2.31.1

Places

File 1636-crypto-Change-and-simplify-the-FIPS-mode-related-mac.patch of Package erlang (Revision 740810ae07adffc1a50bb3a32135aa98)

Places