Skip to content

Crypto: Hide forbidden algorithms when FIPS enabled #10312

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 10 commits into
base: maint
Choose a base branch
from
Draft

Crypto: Hide forbidden algorithms when FIPS enabled #10312

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
aa72b5e
Infrastructure for returning additional fields in crypto:supports/0, /1
kvakvs Oct 14, 2025
fa19b83
Documentation for enable_fips_mode where we discourage its manual inv…
kvakvs Nov 5, 2025
44fe090
Lazy pubkey algorithms init
kvakvs Nov 5, 2025
69805e9
Cipher and MAC algorithms init edits
kvakvs Nov 6, 2025
d5d08e3
New store module for algorithms
kvakvs Nov 6, 2025
06b59d4
Functioning storage for curves and pkeys
kvakvs Nov 6, 2025
d3196a0
Minor changes
kvakvs Nov 7, 2025
dc92bac
Pubkey collections implementation
kvakvs Nov 8, 2025
72a5b56
Digest collection looks good
kvakvs Nov 9, 2025
91b4f05
WIP curve algorithms; auto resource helpers
kvakvs Nov 9, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 12 additions & 3 deletions lib/crypto/c_src/Makefile.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ CC = @DED_CC@
LD = @DED_LD@
SHELL = /bin/sh
LIBS = @DED_LIBS@
LDFLAGS += @DED_LDFLAGS@
LDFLAGS += @DED_LDFLAGS@ -lstdc++
CFLAGS = @DED_CFLAGS@ @SSL_FLAGS@ @DEFS@

# From configure
Expand Down Expand Up @@ -91,14 +91,17 @@ CRYPTO_OBJS = $(OBJDIR)/crypto$(TYPEMARKER).o \
$(OBJDIR)/aead$(TYPEMARKER).o \
$(OBJDIR)/aes$(TYPEMARKER).o \
$(OBJDIR)/algorithms$(TYPEMARKER).o \
$(OBJDIR)/algorithms_collection$(TYPEMARKER).cpp.o \
$(OBJDIR)/algorithms_digest$(TYPEMARKER).cpp.o \
$(OBJDIR)/algorithms_pubkey$(TYPEMARKER).cpp.o \
$(OBJDIR)/algorithms_curve$(TYPEMARKER).cpp.o \
$(OBJDIR)/api_ng$(TYPEMARKER).o \
$(OBJDIR)/atoms$(TYPEMARKER).o \
$(OBJDIR)/bn$(TYPEMARKER).o \
$(OBJDIR)/cipher$(TYPEMARKER).o \
$(OBJDIR)/cmac$(TYPEMARKER).o \
$(OBJDIR)/common$(TYPEMARKER).o \
$(OBJDIR)/dh$(TYPEMARKER).o \
$(OBJDIR)/digest$(TYPEMARKER).o \
$(OBJDIR)/dss$(TYPEMARKER).o \
$(OBJDIR)/ec$(TYPEMARKER).o \
$(OBJDIR)/ecdh$(TYPEMARKER).o \
Expand All @@ -119,7 +122,8 @@ CRYPTO_OBJS = $(OBJDIR)/crypto$(TYPEMARKER).o \
$(OBJDIR)/pbkdf2_hmac$(TYPEMARKER).o

CALLBACK_OBJS = $(OBJDIR)/crypto_callback$(TYPEMARKER).o
CRYPTO_STATIC_OBJS = $(patsubst $(OBJDIR)/%$(TYPEMARKER).o,$(OBJDIR)/%_static$(TYPEMARKER).o,$(CRYPTO_OBJS) $(CALLBACK_OBJS))
CRYPTO_STATIC_OBJS = $(patsubst $(OBJDIR)/%$(TYPEMARKER).o,$(OBJDIR)/%_static$(TYPEMARKER).o,$(CRYPTO_OBJS) $(CALLBACK_OBJS)) \
$(patsubst $(OBJDIR)/%$(TYPEMARKER).cpp.o,$(OBJDIR)/%_static$(TYPEMARKER).cpp.o,$(CRYPTO_OBJS) $(CALLBACK_OBJS))

NIF_ARCHIVE = $(LIBDIR)/crypto$(TYPEMARKER).a

Expand Down Expand Up @@ -180,6 +184,7 @@ endif
CONFIGURE_ARGS = -DDISABLE_EVP_DH=@DISABLE_EVP_DH@ -DDISABLE_EVP_HMAC=@DISABLE_EVP_HMAC@

ALL_CFLAGS = $(TYPE_FLAGS) $(EXTRA_FLAGS) $(CONFIGURE_ARGS) $(INCLUDES)
ALL_CXXFLAGS = $(TYPE_FLAGS) $(EXTRA_FLAGS) $(CONFIGURE_ARGS) $(INCLUDES) -std=c++14
ALL_STATIC_CFLAGS = @DED_STATIC_CFLAGS@ $(TYPE_EXTRA_CFLAGS) $(CONFIGURE_ARGS) $(INCLUDES)

# ----------------------------------------------------
Expand Down Expand Up @@ -222,6 +227,10 @@ $(OBJDIR)/pkey$(TYPEMARKER).o: pkey.c

# ---- End of Hard-coded removal of deprecated warning for ENGINE function calls

$(OBJDIR)/%$(TYPEMARKER).cpp.o: %.cpp
$(V_at)$(INSTALL_DIR) $(OBJDIR)
$(V_CXX) -MMD -c -o $@ $(ALL_CXXFLAGS) $<

$(OBJDIR)/%$(TYPEMARKER).o: %.c
$(V_at)$(INSTALL_DIR) $(OBJDIR)
$(V_CC) -MMD -c -o $@ $(ALL_CFLAGS) $<
Expand Down
4 changes: 2 additions & 2 deletions lib/crypto/c_src/aead.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,7 +111,7 @@ ERL_NIF_TERM aead_cipher_init_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM a
{ret = EXCP_BADARG_N(env, 0, "Bad cipher"); goto done;}
if (! (ctx_res->cipherp->flags & AEAD_CIPHER) )
{ret = EXCP_BADARG_N(env, 0, "Not aead cipher"); goto done;}
if (CIPHER_FORBIDDEN_IN_FIPS(ctx_res->cipherp))
if (IS_CIPHER_FORBIDDEN_IN_FIPS(ctx_res->cipherp))
{ret = EXCP_NOTSUP_N(env, 0, "Forbidden in FIPS"); goto done;}

#if defined(HAVE_GCM_EVP_DECRYPT_BUG)
Expand Down Expand Up @@ -210,7 +210,7 @@ ERL_NIF_TERM aead_cipher_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]
{ret = EXCP_BADARG_N(env, 0, "Bad cipher"); goto done;}
if (! (cipherp->flags & AEAD_CIPHER) )
{ret = EXCP_BADARG_N(env, 0, "Not aead cipher"); goto done;}
if (CIPHER_FORBIDDEN_IN_FIPS(cipherp))
if (IS_CIPHER_FORBIDDEN_IN_FIPS(cipherp))
{ret = EXCP_NOTSUP_N(env, 0, "Forbidden in FIPS"); goto done;}

#if defined(HAVE_GCM_EVP_DECRYPT_BUG)
Expand Down
Loading
Loading