Skip to content

Commit 700b4a4

Browse files
richsalzRich Salz
richsalz
authored and
Rich Salz
committed
Remove more (rest?) of FIPS build stuff.
Reviewed-by: Dr. Stephen Henson <[email protected]>
1 parent 0b0443a commit 700b4a4

File tree

12 files changed

+13
-402
lines changed

12 files changed

+13
-402
lines changed

‎README.FIPS

+1-130
Original file line numberDiff line numberDiff line change
@@ -1,130 +1 @@
1-
Preliminary status and build information for FIPS module v2.0
2-
3-
NB: if you are cross compiling you now need to use the latest "incore" script
4-
this can be found at util/incore in the tarballs.
5-
6-
If you have any object files from a previous build do:
7-
8-
make clean
9-
10-
To build the module do:
11-
12-
./config fipscanisteronly
13-
make
14-
15-
Build should complete without errors.
16-
17-
Build test utilities:
18-
19-
make build_tests
20-
21-
Run test suite:
22-
23-
test/fips_test_suite
24-
25-
again should complete without errors.
26-
27-
Run test vectors:
28-
29-
1. Download an appropriate set of testvectors from www.openssl.org/docs/fips
30-
only the fips-2.0 testvector files are usable for complete tests.
31-
32-
2. Extract the files to a suitable directory.
33-
34-
3. Run the test vector perl script, for example:
35-
36-
cd fips
37-
perl fipsalgtest.pl --dir=/wherever/stuff/was/extracted
38-
39-
4. It should say "passed all tests" at the end. Report full details of any
40-
failures.
41-
42-
If you wish to use the older 1.2.x testvectors (for example those from 2007)
43-
you need the command line switch --disable-v2 to fipsalgtest.pl
44-
45-
Examine the external symbols in fips/fipscanister.o they should all begin
46-
with FIPS or fips. One way to check with GNU nm is:
47-
48-
nm -g --defined-only fips/fipscanister.o | grep -v -i fips
49-
50-
If you get *any* output at all from this test (i.e. symbols not starting with
51-
fips or FIPS) please report it.
52-
53-
Restricted tarball tests.
54-
55-
The validated module will have its own tarball containing sufficient code to
56-
build fipscanister.o and the associated algorithm tests. You can create a
57-
similar tarball yourself for testing purposes using the commands below.
58-
59-
Standard restricted tarball:
60-
61-
make -f Makefile.fips dist
62-
63-
Prime field field only ECC tarball:
64-
65-
make NOEC2M=1 -f Makefile.fips dist
66-
67-
Once you've created the tarball extract into a fresh directory and do:
68-
69-
./config
70-
make
71-
72-
You can then run the algorithm tests as above. This build automatically uses
73-
fipscanisterbuild and no-ec2m as appropriate.
74-
75-
FIPS capable OpenSSL test: WARNING PRELIMINARY INSTRUCTIONS, SUBJECT TO CHANGE.
76-
77-
At least initially the test module and FIPS capable OpenSSL may change and
78-
by out of sync. You are advised to check for any changes and pull the latest
79-
source from CVS if you have problems. See anon CVS and rsync instructions at:
80-
81-
http://www.openssl.org/source/repos.html
82-
83-
Make or download a restricted tarball from ftp://ftp.openssl.org/snapshot/
84-
85-
If required set the environment variable FIPSDIR to an appropriate location
86-
to install the test module. If cross compiling set other environment
87-
variables too.
88-
89-
In this restricted tarball on a Linux or U*ix like system run:
90-
91-
./config
92-
make
93-
make install
94-
95-
On Windows from a VC++ environment do:
96-
97-
ms\do_fips
98-
99-
This will build and install the test module and some associated files.
100-
101-
Now download the latest version of the OpenSSL 1.0.1 branch from either a
102-
snapshot or preferably CVS. For Linux do:
103-
104-
./config fips [other args]
105-
make
106-
107-
For Windows:
108-
109-
perl Configure VC-WIN32 fips [other args]
110-
ms\do_nasm
111-
nmake -f ms\ntdll.mak
112-
113-
(or ms\nt.mak for a static build).
114-
115-
Where [other args] can be any other arguments you use for an OpenSSL build
116-
such as "shared" or "zlib".
117-
118-
This will build the fips capable OpenSSL and link it to the test module. You
119-
can now try linking and testing applications against the FIPS capable OpenSSL.
120-
121-
Please report any problems to either the openssl-dev mailing list or directly
122-
to me [email protected] . Check the mailing lists regularly to avoid duplicate
123-
reports.
124-
125-
Known issues:
126-
127-
Code needs extensively reviewing to ensure it builds correctly on
128-
supported platforms and is compliant with FIPS 140-2.
129-
The "FIPS capable OpenSSL" is still largely untested, it builds and runs
130-
some simple tests OK on some systems but needs far more "real world" testing.
1+
This release does not support a FIPS 140-2 validated module.

‎apps/dgst.c

+2-13
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ typedef enum OPTION_choice {
8080
OPT_C, OPT_R, OPT_RAND, OPT_OUT, OPT_SIGN, OPT_PASSIN, OPT_VERIFY,
8181
OPT_PRVERIFY, OPT_SIGNATURE, OPT_KEYFORM, OPT_ENGINE, OPT_ENGINE_IMPL,
8282
OPT_HEX, OPT_BINARY, OPT_DEBUG, OPT_FIPS_FINGERPRINT,
83-
OPT_NON_FIPS_ALLOW, OPT_HMAC, OPT_MAC, OPT_SIGOPT, OPT_MACOPT,
83+
OPT_HMAC, OPT_MAC, OPT_SIGOPT, OPT_MACOPT,
8484
OPT_DIGEST
8585
} OPTION_CHOICE;
8686

@@ -106,7 +106,6 @@ OPTIONS dgst_options[] = {
106106
{"d", OPT_DEBUG, '-', "Print debug info"},
107107
{"debug", OPT_DEBUG, '-'},
108108
{"fips-fingerprint", OPT_FIPS_FINGERPRINT, '-'},
109-
{"non-fips-allow", OPT_NON_FIPS_ALLOW, '-'},
110109
{"hmac", OPT_HMAC, 's', "Create hashed MAC with key"},
111110
{"mac", OPT_MAC, 's', "Create MAC (not neccessarily HMAC)"},
112111
{"sigopt", OPT_SIGOPT, 's', "Signature parameter in n:v form"},
@@ -133,8 +132,7 @@ int dgst_main(int argc, char **argv)
133132
const char *sigfile = NULL, *randfile = NULL;
134133
OPTION_CHOICE o;
135134
int separator = 0, debug = 0, keyform = FORMAT_PEM, siglen = 0;
136-
int i, ret = 1, out_bin = -1, want_pub = 0, do_verify =
137-
0, non_fips_allow = 0;
135+
int i, ret = 1, out_bin = -1, want_pub = 0, do_verify = 0;
138136
unsigned char *buf = NULL, *sigbuf = NULL;
139137
int engine_impl = 0;
140138

@@ -205,9 +203,6 @@ int dgst_main(int argc, char **argv)
205203
case OPT_FIPS_FINGERPRINT:
206204
hmac_key = "etaonrishdlcupfm";
207205
break;
208-
case OPT_NON_FIPS_ALLOW:
209-
non_fips_allow = 1;
210-
break;
211206
case OPT_HMAC:
212207
hmac_key = opt_arg();
213208
break;
@@ -323,12 +318,6 @@ int dgst_main(int argc, char **argv)
323318
goto end;
324319
}
325320

326-
if (non_fips_allow) {
327-
EVP_MD_CTX *md_ctx;
328-
BIO_get_md_ctx(bmd, &md_ctx);
329-
EVP_MD_CTX_set_flags(md_ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
330-
}
331-
332321
if (hmac_key) {
333322
sigkey = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, impl,
334323
(unsigned char *)hmac_key, -1);

‎apps/dsaparam.c

+2-10
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ static int dsa_cb(int p, int n, BN_GENCB *cb);
8686
typedef enum OPTION_choice {
8787
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
8888
OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_TEXT, OPT_C,
89-
OPT_NOOUT, OPT_GENKEY, OPT_RAND, OPT_NON_FIPS_ALLOW, OPT_ENGINE,
89+
OPT_NOOUT, OPT_GENKEY, OPT_RAND, OPT_ENGINE,
9090
OPT_TIMEBOMB
9191
} OPTION_CHOICE;
9292

@@ -101,7 +101,6 @@ OPTIONS dsaparam_options[] = {
101101
{"noout", OPT_NOOUT, '-', "No output"},
102102
{"genkey", OPT_GENKEY, '-', "Generate a DSA key"},
103103
{"rand", OPT_RAND, 's', "Files to use for random number input"},
104-
{"non-fips-allow", OPT_NON_FIPS_ALLOW, '-'},
105104
# ifdef GENCB_TEST
106105
{"timebomb", OPT_TIMEBOMB, 'p', "Interrupt keygen after 'pnum' seconds"},
107106
# endif
@@ -116,7 +115,7 @@ int dsaparam_main(int argc, char **argv)
116115
DSA *dsa = NULL;
117116
BIO *in = NULL, *out = NULL;
118117
BN_GENCB *cb = NULL;
119-
int numbits = -1, num = 0, genkey = 0, need_rand = 0, non_fips_allow = 0;
118+
int numbits = -1, num = 0, genkey = 0, need_rand = 0;
120119
int informat = FORMAT_PEM, outformat = FORMAT_PEM, noout = 0, C = 0;
121120
int ret = 1, i, text = 0, private = 0;
122121
# ifdef GENCB_TEST
@@ -175,9 +174,6 @@ int dsaparam_main(int argc, char **argv)
175174
case OPT_NOOUT:
176175
noout = 1;
177176
break;
178-
case OPT_NON_FIPS_ALLOW:
179-
non_fips_allow = 1;
180-
break;
181177
}
182178
}
183179
argc = opt_num_rest();
@@ -219,8 +215,6 @@ int dsaparam_main(int argc, char **argv)
219215
BIO_printf(bio_err, "Error allocating DSA object\n");
220216
goto end;
221217
}
222-
if (non_fips_allow)
223-
dsa->flags |= DSA_FLAG_NON_FIPS_ALLOW;
224218
BIO_printf(bio_err, "Generating DSA parameters, %d bit long prime\n",
225219
num);
226220
BIO_printf(bio_err, "This could take some time\n");
@@ -309,8 +303,6 @@ int dsaparam_main(int argc, char **argv)
309303
assert(need_rand);
310304
if ((dsakey = DSAparams_dup(dsa)) == NULL)
311305
goto end;
312-
if (non_fips_allow)
313-
dsakey->flags |= DSA_FLAG_NON_FIPS_ALLOW;
314306
if (!DSA_generate_key(dsakey)) {
315307
ERR_print_errors(bio_err);
316308
DSA_free(dsakey);

‎apps/enc.c

+2-9
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ typedef enum OPTION_choice {
8484
OPT_E, OPT_IN, OPT_OUT, OPT_PASS, OPT_ENGINE, OPT_D, OPT_P, OPT_V,
8585
OPT_NOPAD, OPT_SALT, OPT_NOSALT, OPT_DEBUG, OPT_UPPER_P, OPT_UPPER_A,
8686
OPT_A, OPT_Z, OPT_BUFSIZE, OPT_K, OPT_KFILE, OPT_UPPER_K, OPT_NONE,
87-
OPT_UPPER_S, OPT_IV, OPT_MD, OPT_NON_FIPS_ALLOW, OPT_CIPHER
87+
OPT_UPPER_S, OPT_IV, OPT_MD, OPT_CIPHER
8888
} OPTION_CHOICE;
8989

9090
OPTIONS enc_options[] = {
@@ -111,7 +111,6 @@ OPTIONS enc_options[] = {
111111
{"S", OPT_UPPER_S, 's', "Salt, in hex"},
112112
{"iv", OPT_IV, 's', "IV in hex"},
113113
{"md", OPT_MD, 's', "Use specified digest to create key from passphrase"},
114-
{"non-fips-allow", OPT_NON_FIPS_ALLOW, '-'},
115114
{"none", OPT_NONE, '-', "Don't encrypt"},
116115
{"", OPT_CIPHER, '-', "Any supported cipher"},
117116
#ifdef ZLIB
@@ -140,7 +139,7 @@ int enc_main(int argc, char **argv)
140139
int bsize = BSIZE, verbose = 0, debug = 0, olb64 = 0, nosalt = 0;
141140
int enc = 1, printkey = 0, i, k;
142141
int base64 = 0, informat = FORMAT_BINARY, outformat = FORMAT_BINARY;
143-
int ret = 1, inl, nopad = 0, non_fips_allow = 0;
142+
int ret = 1, inl, nopad = 0;
144143
unsigned char key[EVP_MAX_KEY_LENGTH], iv[EVP_MAX_IV_LENGTH];
145144
unsigned char *buff = NULL, salt[PKCS5_SALT_LEN];
146145
unsigned long n;
@@ -279,9 +278,6 @@ int enc_main(int argc, char **argv)
279278
if (!opt_md(opt_arg(), &dgst))
280279
goto opthelp;
281280
break;
282-
case OPT_NON_FIPS_ALLOW:
283-
non_fips_allow = 1;
284-
break;
285281
case OPT_CIPHER:
286282
if (!opt_cipher(opt_unknown(), &c))
287283
goto opthelp;
@@ -501,9 +497,6 @@ int enc_main(int argc, char **argv)
501497

502498
BIO_get_cipher_ctx(benc, &ctx);
503499

504-
if (non_fips_allow)
505-
EVP_CIPHER_CTX_set_flags(ctx, EVP_CIPH_FLAG_NON_FIPS_ALLOW);
506-
507500
if (!EVP_CipherInit_ex(ctx, cipher, NULL, NULL, NULL, enc)) {
508501
BIO_printf(bio_err, "Error setting cipher %s\n",
509502
EVP_CIPHER_name(cipher));

‎apps/genrsa.c

+2-9
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ static int genrsa_cb(int p, int n, BN_GENCB *cb);
7878

7979
typedef enum OPTION_choice {
8080
OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
81-
OPT_3, OPT_F4, OPT_NON_FIPS_ALLOW, OPT_ENGINE,
81+
OPT_3, OPT_F4, OPT_ENGINE,
8282
OPT_OUT, OPT_RAND, OPT_PASSOUT, OPT_CIPHER
8383
} OPTION_CHOICE;
8484

@@ -87,7 +87,6 @@ OPTIONS genrsa_options[] = {
8787
{"3", OPT_3, '-', "Use 3 for the E value"},
8888
{"F4", OPT_F4, '-', "Use F4 (0x10001) for the E value"},
8989
{"f4", OPT_F4, '-', "Use F4 (0x10001) for the E value"},
90-
{"non-fips-allow", OPT_NON_FIPS_ALLOW, '-'},
9190
{"out", OPT_OUT, 's', "Output the key to specified file"},
9291
{"rand", OPT_RAND, 's',
9392
"Load the file(s) into the random number generator"},
@@ -108,7 +107,7 @@ int genrsa_main(int argc, char **argv)
108107
BIO *out = NULL;
109108
RSA *rsa = NULL;
110109
const EVP_CIPHER *enc = NULL;
111-
int ret = 1, non_fips_allow = 0, num = DEFBITS, private = 0;
110+
int ret = 1, num = DEFBITS, private = 0;
112111
unsigned long f4 = RSA_F4;
113112
char *outfile = NULL, *passoutarg = NULL, *passout = NULL;
114113
char *inrand = NULL, *prog, *hexe, *dece;
@@ -136,9 +135,6 @@ int genrsa_main(int argc, char **argv)
136135
case OPT_F4:
137136
f4 = RSA_F4;
138137
break;
139-
case OPT_NON_FIPS_ALLOW:
140-
non_fips_allow = 1;
141-
break;
142138
case OPT_OUT:
143139
outfile = opt_arg();
144140
break;
@@ -188,9 +184,6 @@ int genrsa_main(int argc, char **argv)
188184
if (rsa == NULL)
189185
goto end;
190186

191-
if (non_fips_allow)
192-
rsa->flags |= RSA_FLAG_NON_FIPS_ALLOW;
193-
194187
if (!BN_set_word(bn, f4) || !RSA_generate_key_ex(rsa, num, bn, cb))
195188
goto end;
196189

0 commit comments

Comments
 (0)