Commit 086e32a6 authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Implement FIPS_mode and FIPS_mode_set

parent 05b4fc6c

CHANGES

+4 −0
Original line number Diff line number Diff line
@@ -4,6 +4,10 @@ 


 Changes between 1.0.1 and 1.1.0  [xx XXX xxxx]



  *) Functions FIPS_mode_set() and FIPS_mode() which call the underlying

     FIPS modules versions.

     [Steve Henson]



  *) Add TLS v1.2 client side support for client authentication. Keep cache

     of handshake records longer as we don't know the hash algorithm to use

     until after the certificate request message is received.

apps/openssl.c

+1 −4
Original line number Diff line number Diff line
@@ -315,10 +315,7 @@ int main(int Argc, char *ARGV[]) 


	if(getenv("OPENSSL_FIPS")) {

#ifdef OPENSSL_FIPS

		/* For now call FIPS_module_mode_set(): will call

		 * FIPS_mode_set() later.

		 */

		if (!FIPS_module_mode_set(1)) {

		if (!FIPS_mode_set(1)) {

			ERR_load_crypto_strings();

			ERR_print_errors(BIO_new_fp(stderr,BIO_NOCLOSE));

			EXIT(1);

crypto/Makefile

+2 −2
Original line number Diff line number Diff line
@@ -36,10 +36,10 @@ LIB= $(TOP)/libcrypto.a 
SHARED_LIB= libcrypto$(SHLIB_EXT)

LIBSRC=	cryptlib.c mem.c mem_clr.c mem_dbg.c cversion.c ex_data.c cpt_err.c \

	ebcdic.c uid.c o_time.c o_str.c o_dir.c thr_id.c lock.c fips_ers.c \

	o_init.c

	o_init.c o_fips.c

LIBOBJ= cryptlib.o mem.o mem_dbg.o cversion.o ex_data.o cpt_err.o \

	ebcdic.o uid.o o_time.o o_str.o o_dir.o thr_id.o lock.o fips_ers.o \

	o_init.o $(CPUID_OBJ)

	o_init.o o_fips.o $(CPUID_OBJ)



SRC= $(LIBSRC)

crypto/cpt_err.c

+3 −1
Original line number Diff line number Diff line 
/* crypto/cpt_err.c */

/* ====================================================================

 * Copyright (c) 1999-2006 The OpenSSL Project.  All rights reserved.

 * Copyright (c) 1999-2011 The OpenSSL Project.  All rights reserved.

 *

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions
@@ -76,6 +76,7 @@ static ERR_STRING_DATA CRYPTO_str_functs[]= 
{ERR_FUNC(CRYPTO_F_CRYPTO_SET_EX_DATA),	"CRYPTO_set_ex_data"},

{ERR_FUNC(CRYPTO_F_DEF_ADD_INDEX),	"DEF_ADD_INDEX"},

{ERR_FUNC(CRYPTO_F_DEF_GET_CLASS),	"DEF_GET_CLASS"},

{ERR_FUNC(CRYPTO_F_FIPS_MODE_SET),	"FIPS_mode_set"},

{ERR_FUNC(CRYPTO_F_INT_DUP_EX_DATA),	"INT_DUP_EX_DATA"},

{ERR_FUNC(CRYPTO_F_INT_FREE_EX_DATA),	"INT_FREE_EX_DATA"},

{ERR_FUNC(CRYPTO_F_INT_NEW_EX_DATA),	"INT_NEW_EX_DATA"},
@@ -84,6 +85,7 @@ static ERR_STRING_DATA CRYPTO_str_functs[]= 


static ERR_STRING_DATA CRYPTO_str_reasons[]=

	{

{ERR_REASON(CRYPTO_R_FIPS_MODE_NOT_SUPPORTED),"fips mode not supported"},

{ERR_REASON(CRYPTO_R_NO_DYNLOCK_CREATE_CALLBACK),"no dynlock create callback"},

{0,NULL}

	};

crypto/crypto.h

+5 −0
Original line number Diff line number Diff line
@@ -560,6 +560,9 @@ unsigned int *OPENSSL_ia32cap_loc(void); 
#define OPENSSL_ia32cap ((OPENSSL_ia32cap_loc())[0])

int OPENSSL_isservice(void);



int FIPS_mode(void);

int FIPS_mode_set(int r);



/* BEGIN ERROR CODES */

/* The following lines are auto generated by the script mkerr.pl. Any changes

 * made after this point may be overwritten when the script is next run.
@@ -575,11 +578,13 @@ void ERR_load_CRYPTO_strings(void); 
#define CRYPTO_F_CRYPTO_SET_EX_DATA			 102

#define CRYPTO_F_DEF_ADD_INDEX				 104

#define CRYPTO_F_DEF_GET_CLASS				 105

#define CRYPTO_F_FIPS_MODE_SET				 109

#define CRYPTO_F_INT_DUP_EX_DATA			 106

#define CRYPTO_F_INT_FREE_EX_DATA			 107

#define CRYPTO_F_INT_NEW_EX_DATA			 108



/* Reason codes. */

#define CRYPTO_R_FIPS_MODE_NOT_SUPPORTED		 101

#define CRYPTO_R_NO_DYNLOCK_CREATE_CALLBACK		 100



#ifdef  __cplusplus