Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use new OpenSSL FIPS API as to support build with OpenSSL 3 #124

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Use new OpenSSL FIPS API as to support build with OpenSSL 3 #124

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion example/client-brski/estclient-brski.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <openssl/crypto.h>
#include <openssl/evp.h>
#ifndef WIN32
#include <strings.h>
#endif
Expand Down Expand Up @@ -388,7 +389,7 @@ int main (int argc, char **argv)
break;
case 'f':
/* Turn FIPS on if requested and exit if failure */
set_fips_return = FIPS_mode_set(1);
set_fips_return = EVP_default_properties_enable_fips(NULL, 1);
if (!set_fips_return) {
printf("\nERROR setting FIPS MODE ON ...\n");
ERR_load_crypto_strings();
Expand Down
3 changes: 2 additions & 1 deletion example/client/estclient.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@
#include <sys/stat.h>
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <openssl/evp.h>
#include <openssl/crypto.h>
#include <openssl/pem.h>
#ifndef WIN32
Expand Down Expand Up @@ -1280,7 +1281,7 @@ int main (int argc, char **argv)
break;
case 'f':
/* Turn FIPS on if requested and exit if failure */
set_fips_return = FIPS_mode_set(1);
set_fips_return = EVP_default_properties_enable_fips(NULL, 1);
if (!set_fips_return) {
printf("\nERROR setting FIPS MODE ON ...\n");
ERR_load_crypto_strings();
Expand Down
3 changes: 2 additions & 1 deletion example/proxy/estproxy.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@
#include <getopt.h>
#include <openssl/ssl.h>
#include <openssl/bio.h>
#include <openssl/evp.h>
#include <est.h>
#include <sys/types.h>
#ifndef WIN32
Expand Down Expand Up @@ -593,7 +594,7 @@ int main (int argc, char **argv)
/*
* Turn FIPS on if user requested it and exit if failure
*/
set_fips_return = FIPS_mode_set(1);
set_fips_return = EVP_default_properties_enable_fips(NULL, 1);
if (set_fips_return != 1) {
set_fips_error = ERR_get_error();
printf("\nERROR WHILE SETTING FIPS MODE ON exiting ....\n");
Expand Down
3 changes: 2 additions & 1 deletion example/server/estserver.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@
#include <openssl/conf.h>
#include <openssl/ssl.h>
#include <openssl/bio.h>
#include <openssl/evp.h>
#include <openssl/crypto.h>
#include <openssl/pem.h>
#include <openssl/md5.h>
Expand Down Expand Up @@ -2285,7 +2286,7 @@ int main (int argc, char **argv)
/* turn FIPS on if user requested it
* and exit if failure.
*/
set_fips_return = FIPS_mode_set(1);
set_fips_return = EVP_default_properties_enable_fips(NULL, 1);
if (set_fips_return != 1) {
set_fips_error = ERR_get_error();
printf("\nERROR WHILE SETTING FIPS MODE ON exiting ....\n");
Expand Down
3 changes: 2 additions & 1 deletion java/jni/client.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@
#include <est/est.h>
#include <openssl/x509v3.h>
#include <openssl/bio.h>
#include <openssl/evp.h>
#include "safe_mem_lib.h"

#define EST_CLASS_ENROLL_EXCEPTION "com/cisco/c3m/est/EnrollException"
Expand Down Expand Up @@ -179,7 +180,7 @@ static int jni_est_client_X509_REQ_sign (X509_REQ *x, EVP_PKEY *pkey, const EVP_
*/
JNIEXPORT jint JNICALL Java_com_cisco_c3m_est_ESTClient_enable_1fips(
JNIEnv *env, jclass obj) {
if (!FIPS_mode() && !FIPS_mode_set(1)) {
if (!EVP_default_properties_is_fips_enabled(NULL) && !EVP_default_properties_enable_fips(NULL, 1)) {
ERR_print_errors_fp(stderr);
return -1;
} else {
Expand Down
13 changes: 7 additions & 6 deletions src/est/est_client.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,7 @@
#include <openssl/ssl.h>
#include <openssl/cms.h>
#include <openssl/rand.h>
#include <openssl/evp.h>
#include "est.h"
#include "est_locl.h"
#include "est_ossl_util.h"
Expand Down Expand Up @@ -3182,7 +3183,7 @@ EST_ERROR est_client_enroll_internal (EST_CTX *ctx, char *cn, int *pkcs7_len, in
* HTTPS digest mode requires the use of MD5. Make sure we're not
* in FIPS mode and can use MD5
*/
if (ctx->auth_mode == AUTH_DIGEST && (FIPS_mode())){
if (ctx->auth_mode == AUTH_DIGEST && (EVP_default_properties_is_fips_enabled(NULL))){
EST_LOG_ERR("HTTP digest auth not allowed while in FIPS mode");
rv = EST_ERR_BAD_MODE;
goto err;
Expand Down Expand Up @@ -3593,7 +3594,7 @@ EST_ERROR est_client_reenroll (EST_CTX *ctx, X509 *cert, int *pkcs7_len, EVP_PKE
* HTTPS digest mode requires the use of MD5. Make sure we're not
* in FIPS mode and can use MD5
*/
if (ctx->auth_mode == AUTH_DIGEST && (FIPS_mode())){
if (ctx->auth_mode == AUTH_DIGEST && (EVP_default_properties_is_fips_enabled(NULL))){
EST_LOG_ERR("HTTP digest auth not allowed while in FIPS mode");
rv = EST_ERR_BAD_MODE;
goto err;
Expand Down Expand Up @@ -3679,7 +3680,7 @@ static EST_ERROR est_client_enroll_csr_internal (EST_CTX *ctx, X509_REQ *csr, in
* HTTPS digest mode requires the use of MD5. Make sure we're not
* in FIPS mode and can use MD5
*/
if (ctx->auth_mode == AUTH_DIGEST && (FIPS_mode())){
if (ctx->auth_mode == AUTH_DIGEST && (EVP_default_properties_is_fips_enabled(NULL))){
EST_LOG_ERR("HTTP digest auth not allowed while in FIPS mode");
rv = EST_ERR_BAD_MODE;
goto err;
Expand Down Expand Up @@ -5871,7 +5872,7 @@ static EST_ERROR est_client_brski_send_get_voucher (EST_CTX *ctx, int *cacert_le
* HTTPS digest mode requires the use of MD5. Make sure we're not
* in FIPS mode and can use MD5
*/
if (ctx->auth_mode == AUTH_DIGEST && (FIPS_mode())){
if (ctx->auth_mode == AUTH_DIGEST && (EVP_default_properties_is_fips_enabled(NULL))){
EST_LOG_ERR("HTTP digest auth not allowed while in FIPS mode");
rv = EST_ERR_BAD_MODE;
goto err;
Expand Down Expand Up @@ -6365,7 +6366,7 @@ EST_ERROR est_client_brski_send_voucher_status (EST_CTX *ctx, EST_BRSKI_STATUS_V
* HTTPS digest mode requires the use of MD5. Make sure we're not
* in FIPS mode and can use MD5
*/
if (ctx->auth_mode == AUTH_DIGEST && (FIPS_mode())){
if (ctx->auth_mode == AUTH_DIGEST && (EVP_default_properties_is_fips_enabled(NULL))){
EST_LOG_ERR("HTTP digest auth not allowed while in FIPS mode");
rv = EST_ERR_BAD_MODE;
goto err;
Expand Down Expand Up @@ -6534,7 +6535,7 @@ EST_ERROR est_client_brski_send_enroll_status (EST_CTX *ctx, EST_BRSKI_STATUS_VA
* HTTPS digest mode requires the use of MD5. Make sure we're not
* in FIPS mode and can use MD5
*/
if (ctx->auth_mode == AUTH_DIGEST && (FIPS_mode())){
if (ctx->auth_mode == AUTH_DIGEST && (EVP_default_properties_is_fips_enabled(NULL))){
EST_LOG_ERR("HTTP digest auth not allowed while in FIPS mode");
rv = EST_ERR_BAD_MODE;
goto err;
Expand Down
3 changes: 2 additions & 1 deletion src/est/est_server.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,7 @@
#include <openssl/x509v3.h>
#include <openssl/cms.h>
#include <openssl/bio.h>
#include <openssl/evp.h>


static ASN1_OBJECT *o_cmcRA = NULL;
Expand Down Expand Up @@ -3355,7 +3356,7 @@ EST_ERROR est_server_set_auth_mode (EST_CTX *ctx, EST_HTTP_AUTH_MODE amode)
/*
* Since HTTP digest auth uses MD5, make sure we're not in FIPS mode.
*/
if (FIPS_mode()) {
if (EVP_default_properties_is_fips_enabled(NULL)) {
EST_LOG_ERR("HTTP digest auth not allowed while in FIPS mode");
return (EST_ERR_BAD_MODE);
}
Expand Down
5 changes: 3 additions & 2 deletions test/UT/US1864/us1864.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
#include "test_utils.h"
#include "st_server.h"
#include <openssl/ssl.h>
#include <openssl/evp.h>

#ifdef HAVE_CUNIT
#include "CUnit/Basic.h"
Expand Down Expand Up @@ -218,12 +219,12 @@ static void us1864_test1 (void)
/*
* Make sure we don't allow DIGEST mode when in FIPS mode
*/
if (!FIPS_mode_set(1)) {
if (!EVP_default_properties_enable_fips(NULL, 1)) {
printf("FIPS mode not supported, skipping test to prevent digest auth when in FIPS mode");
} else {
est_rv = est_server_set_auth_mode(ctx, AUTH_DIGEST);
CU_ASSERT(est_rv == EST_ERR_BAD_MODE);
FIPS_mode_set(0);
EVP_default_properties_enable_fips(NULL, 0)
}

X509_free(x);
Expand Down