openssl/openssl-0.9.8j-use-fipscheck.patch

   1 Use fipscheck compatible way of verification of the integrity of the libcrypto
   2 shared library.
   3 diff -up openssl-0.9.8j/test/Makefile.use-fipscheck openssl-0.9.8j/test/Makefile
   4 --- openssl-0.9.8j/test/Makefile.use-fipscheck  2008-12-13 13:22:47.000000000 +0100
   5 +++ openssl-0.9.8j/test/Makefile        2009-01-13 22:49:25.000000000 +0100
   6 @@ -402,8 +402,7 @@ FIPS_BUILD_CMD=shlib_target=; if [ -n "$
   7         if [ "$(FIPSCANLIB)" = "libfips" ]; then \
   8                 LIBRARIES="-L$(TOP) -lfips"; \
   9         elif [ -n "$(FIPSCANLIB)" ]; then \
  10 -               FIPSLD_CC=$(CC); CC=$(TOP)/fips/fipsld; export CC FIPSLD_CC; \
  11 -               LIBRARIES="$${FIPSLIBDIR:-$(TOP)/fips/}fipscanister.o"; \
  12 +               LIBRARIES="$(LIBCRYPTO)"; \
  13         fi; \
  14         $(MAKE) -f $(TOP)/Makefile.shared -e \
  15                 CC=$${CC} APPNAME=$$target$(EXE_EXT) OBJECTS="$$target.o" \
  16 @@ -414,9 +413,6 @@ FIPS_CRYPTO_BUILD_CMD=shlib_target=; if
  17                 shlib_target="$(SHLIB_TARGET)"; \
  18         fi; \
  19         LIBRARIES="$(LIBSSL) $(LIBCRYPTO) $(LIBKRB5)"; \
  20 -       if [ -z "$(SHARED_LIBS)" -a -n "$(FIPSCANLIB)" ] ; then \
  21 -               FIPSLD_CC=$(CC); CC=$(TOP)/fips/fipsld; export CC FIPSLD_CC; \
  22 -       fi; \
  23         [ "$(FIPSCANLIB)" = "libfips" ] && LIBRARIES="$$LIBRARIES -lfips"; \
  24         $(MAKE) -f $(TOP)/Makefile.shared -e \
  25                 CC=$${CC} APPNAME=$$target$(EXE_EXT) OBJECTS="$$target.o" \
  26 diff -up openssl-0.9.8j/Makefile.org.use-fipscheck openssl-0.9.8j/Makefile.org
  27 --- openssl-0.9.8j/Makefile.org.use-fipscheck   2009-01-13 22:35:48.000000000 +0100
  28 +++ openssl-0.9.8j/Makefile.org 2009-01-13 22:35:49.000000000 +0100
  29 @@ -357,10 +357,6 @@ libcrypto$(SHLIB_EXT): libcrypto.a $(SHA
  30                         $(MAKE) SHLIBDIRS='crypto' SHLIBDEPS='-lfips' build-shared; \
  31                         $(AR) libcrypto.a fips/fipscanister.o ; \
  32                 else \
  33 -                       if [ "$(FIPSCANLIB)" = "libcrypto" ]; then \
  34 -                               FIPSLD_CC=$(CC); CC=fips/fipsld; \
  35 -                               export CC FIPSLD_CC; \
  36 -                       fi; \
  37                         $(MAKE) -e SHLIBDIRS='crypto' build-shared; \
  38                 fi \
  39         else \
  40 @@ -381,9 +377,8 @@ libssl$(SHLIB_EXT): libcrypto$(SHLIB_EXT
  41  fips/fipscanister.o:   build_fips
  42  libfips$(SHLIB_EXT):           fips/fipscanister.o
  43         @if [ "$(SHLIB_TARGET)" != "" ]; then \
  44 -               FIPSLD_CC=$(CC); CC=fips/fipsld; export CC FIPSLD_CC; \
  45                 $(MAKE) -f Makefile.shared -e $(BUILDENV) \
  46 -                       CC=$${CC} LIBNAME=fips THIS=$@ \
  47 +                       CC=$(CC) LIBNAME=fips THIS=$@ \
  48                         LIBEXTRAS=fips/fipscanister.o \
  49                         LIBDEPS="$(EX_LIBS)" \
  50                         LIBVERSION=${SHLIB_MAJOR}.${SHLIB_MINOR} \
  51 @@ -469,7 +464,7 @@ openssl.pc: Makefile
  52             echo 'Description: Secure Sockets Layer and cryptography libraries and tools'; \
  53             echo 'Version: '$(VERSION); \
  54             echo 'Requires: '; \
  55 -           echo 'Libs: -L$${libdir} -lssl -lcrypto $(EX_LIBS)'; \
  56 +           echo 'Libs: -L$${libdir} -lssl -lcrypto $(EX_LIBS)';\
  57             echo 'Cflags: -I$${includedir} $(KRB5_INCLUDES)' ) > openssl.pc
  58
  59  Makefile: Makefile.org Configure config
  60 diff -up openssl-0.9.8j/fips/fips.c.use-fipscheck openssl-0.9.8j/fips/fips.c
  61 --- openssl-0.9.8j/fips/fips.c.use-fipscheck    2008-09-16 12:12:09.000000000 +0200
  62 +++ openssl-0.9.8j/fips/fips.c  2009-01-13 22:35:49.000000000 +0100
  63 @@ -47,6 +47,7 @@
  64   *
  65   */
  66
  67 +#define _GNU_SOURCE
  68
  69  #include <openssl/rand.h>
  70  #include <openssl/fips_rand.h>
  71 @@ -56,6 +57,9 @@
  72  #include <openssl/rsa.h>
  73  #include <string.h>
  74  #include <limits.h>
  75 +#include <dlfcn.h>
  76 +#include <stdio.h>
  77 +#include <stdlib.h>
  78  #include "fips_locl.h"
  79
  80  #ifdef OPENSSL_FIPS
  81 @@ -165,6 +169,7 @@ int FIPS_selftest()
  82         && FIPS_selftest_dsa();
  83      }
  84
  85 +#if 0
  86  extern const void         *FIPS_text_start(),  *FIPS_text_end();
  87  extern const unsigned char FIPS_rodata_start[], FIPS_rodata_end[];
  88  unsigned char              FIPS_signature [20] = { 0 };
  89 @@ -243,6 +248,206 @@ int FIPS_check_incore_fingerprint(void)
  90
  91      return 1;
  92      }
  93 +#else
  94 +/* we implement what libfipscheck does ourselves */
  95 +
  96 +static int
  97 +get_library_path(const char *libname, const char *symbolname, char *path, size_t pathlen)
  98 +{
  99 +       Dl_info info;
 100 +       void *dl, *sym;
 101 +       int rv = -1;
 102 +
 103 +        dl = dlopen(libname, RTLD_NODELETE|RTLD_NOLOAD|RTLD_LAZY);
 104 +        if (dl == NULL) {
 105 +               return -1;
 106 +        }
 107 +
 108 +       sym = dlsym(dl, symbolname);
 109 +
 110 +       if (sym != NULL && dladdr(sym, &info)) {
 111 +               strncpy(path, info.dli_fname, pathlen-1);
 112 +               path[pathlen-1] = '\0';
 113 +               rv = 0;
 114 +       }
 115 +
 116 +       dlclose(dl);
 117 +
 118 +       return rv;
 119 +}
 120 +
 121 +static const char conv[] = "0123456789abcdef";
 122 +
 123 +static char *
 124 +bin2hex(void *buf, size_t len)
 125 +{
 126 +       char *hex, *p;
 127 +       unsigned char *src = buf;
 128 +
 129 +       hex = malloc(len * 2 + 1);
 130 +       if (hex == NULL)
 131 +               return NULL;
 132 +
 133 +       p = hex;
 134 +
 135 +       while (len > 0) {
 136 +               unsigned c;
 137 +
 138 +               c = *src;
 139 +               src++;
 140 +
 141 +               *p = conv[c >> 4];
 142 +               ++p;
 143 +               *p = conv[c & 0x0f];
 144 +               ++p;
 145 +               --len;
 146 +       }
 147 +       *p = '\0';
 148 +       return hex;
 149 +}
 150 +
 151 +#define HMAC_PREFIX "."
 152 +#define HMAC_SUFFIX ".hmac"
 153 +#define READ_BUFFER_LENGTH 16384
 154 +
 155 +static char *
 156 +make_hmac_path(const char *origpath)
 157 +{
 158 +       char *path, *p;
 159 +       const char *fn;
 160 +
 161 +       path = malloc(sizeof(HMAC_PREFIX) + sizeof(HMAC_SUFFIX) + strlen(origpath));
 162 +       if(path == NULL) {
 163 +               return NULL;
 164 +       }
 165 +
 166 +       fn = strrchr(origpath, '/');
 167 +       if (fn == NULL) {
 168 +               fn = origpath;
 169 +       } else {
 170 +               ++fn;
 171 +       }
 172 +
 173 +       strncpy(path, origpath, fn-origpath);
 174 +       p = path + (fn - origpath);
 175 +       p = stpcpy(p, HMAC_PREFIX);
 176 +       p = stpcpy(p, fn);
 177 +       p = stpcpy(p, HMAC_SUFFIX);
 178 +
 179 +       return path;
 180 +}
 181 +
 182 +static const char hmackey[] = "orboDeJITITejsirpADONivirpUkvarP";
 183 +
 184 +static int
 185 +compute_file_hmac(const char *path, void **buf, size_t *hmaclen)
 186 +{
 187 +       FILE *f = NULL;
 188 +       int rv = -1;
 189 +       unsigned char rbuf[READ_BUFFER_LENGTH];
 190 +       size_t len;
 191 +       unsigned int hlen;
 192 +       HMAC_CTX c;
 193 +
 194 +       HMAC_CTX_init(&c);
 195 +
 196 +       f = fopen(path, "r");
 197 +
 198 +       if (f == NULL) {
 199 +               goto end;
 200 +       }
 201 +
 202 +       HMAC_Init(&c, hmackey, sizeof(hmackey)-1, EVP_sha256());
 203 +
 204 +       while ((len=fread(rbuf, 1, sizeof(rbuf), f)) != 0) {
 205 +               HMAC_Update(&c, rbuf, len);
 206 +       }
 207 +
 208 +       len = sizeof(rbuf);
 209 +       /* reuse rbuf for hmac */
 210 +       HMAC_Final(&c, rbuf, &hlen);
 211 +
 212 +       *buf = malloc(hlen);
 213 +       if (*buf == NULL) {
 214 +               goto end;
 215 +       }
 216 +
 217 +       *hmaclen = hlen;
 218 +
 219 +       memcpy(*buf, rbuf, hlen);
 220 +
 221 +       rv = 0;
 222 +end:
 223 +       HMAC_CTX_cleanup(&c);
 224 +
 225 +       if (f)
 226 +               fclose(f);
 227 +
 228 +       return rv;
 229 +}
 230 +
 231 +static int
 232 +FIPSCHECK_verify(const char *libname, const char *symbolname)
 233 +{
 234 +       char path[PATH_MAX+1];
 235 +       int rv;
 236 +       FILE *hf;
 237 +       char *hmacpath, *p;
 238 +       char *hmac = NULL;
 239 +       size_t n;
 240 +
 241 +       rv = get_library_path(libname, symbolname, path, sizeof(path));
 242 +
 243 +       if (rv < 0)
 244 +               return 0;
 245 +
 246 +       hmacpath = make_hmac_path(path);
 247 +
 248 +       hf = fopen(hmacpath, "r");
 249 +       if (hf == NULL) {
 250 +               free(hmacpath);
 251 +               return 0;
 252 +       }
 253 +
 254 +       if (getline(&hmac, &n, hf) > 0) {
 255 +               void *buf;
 256 +               size_t hmaclen;
 257 +               char *hex;
 258 +
 259 +               if ((p=strchr(hmac, '\n')) != NULL)
 260 +                       *p = '\0';
 261 +
 262 +               if (compute_file_hmac(path, &buf, &hmaclen) < 0) {
 263 +                       rv = -4;
 264 +                       goto end;
 265 +               }
 266 +
 267 +               if ((hex=bin2hex(buf, hmaclen)) == NULL) {
 268 +                       free(buf);
 269 +                       rv = -5;
 270 +                       goto end;
 271 +               }
 272 +
 273 +               if (strcmp(hex, hmac) != 0) {
 274 +                       rv = -1;
 275 +               }
 276 +               free(buf);
 277 +               free(hex);
 278 +       }
 279 +
 280 +end:
 281 +       free(hmac);
 282 +       free(hmacpath);
 283 +       fclose(hf);
 284 +
 285 +       if (rv < 0)
 286 +               return 0;
 287 +
 288 +       /* check successful */
 289 +       return 1;
 290 +}
 291 +
 292 +#endif
 293
 294  int FIPS_mode_set(int onoff)
 295      {
 296 @@ -280,16 +485,9 @@ int FIPS_mode_set(int onoff)
 297             }
 298  #endif
 299
 300 -       if(fips_signature_witness() != FIPS_signature)
 301 -           {
 302 -           FIPSerr(FIPS_F_FIPS_MODE_SET,FIPS_R_CONTRADICTING_EVIDENCE);
 303 -           fips_selftest_fail = 1;
 304 -           ret = 0;
 305 -           goto end;
 306 -           }
 307 -
 308 -       if(!FIPS_check_incore_fingerprint())
 309 +       if(!FIPSCHECK_verify("libcrypto.so.0.9.8e","FIPS_mode_set"))
 310             {
 311 +           FIPSerr(FIPS_F_FIPS_MODE_SET,FIPS_R_FINGERPRINT_DOES_NOT_MATCH);
 312             fips_selftest_fail = 1;
 313             ret = 0;
 314             goto end;
 315 @@ -405,11 +603,13 @@ int fips_clear_owning_thread(void)
 316         return ret;
 317         }
 318
 319 +#if 0
 320  unsigned char *fips_signature_witness(void)
 321         {
 322         extern unsigned char FIPS_signature[];
 323         return FIPS_signature;
 324         }
 325 +#endif
 326
 327  /* Generalized public key test routine. Signs and verifies the data
 328   * supplied in tbs using mesage digest md and setting option digest
 329 diff -up openssl-0.9.8j/fips/Makefile.use-fipscheck openssl-0.9.8j/fips/Makefile
 330 --- openssl-0.9.8j/fips/Makefile.use-fipscheck  2009-01-13 22:35:49.000000000 +0100
 331 +++ openssl-0.9.8j/fips/Makefile        2009-01-13 22:36:15.000000000 +0100
 332 @@ -62,9 +62,9 @@ testapps:
 333
 334  all:
 335         @if [ -z "$(FIPSLIBDIR)" ]; then \
 336 -               $(MAKE) -e subdirs lib fips_premain_dso$(EXE_EXT); \
 337 +               $(MAKE) -e subdirs lib; \
 338         else \
 339 -               $(MAKE) -e lib fips_premain_dso$(EXE_EXT) fips_standalone_sha1$(EXE_EXT); \
 340 +               $(MAKE) -e lib; \
 341         fi
 342
 343  # Idea behind fipscanister.o is to "seize" the sequestered code between
 344 @@ -109,7 +109,6 @@ fipscanister.o: fips_start.o $(LIBOBJ) $
 345                 HP-UX|OSF1|SunOS) set -x; /usr/ccs/bin/ld -r -o $@ $$objs ;; \
 346                 *) set -x; $(CC) $$cflags -r -o $@ $$objs ;; \
 347         esac fi
 348 -       ./fips_standalone_sha1 fipscanister.o > fipscanister.o.sha1
 349
 350  # If another exception is immediately required, assign approprite
 351  # site-specific ld command to FIPS_SITE_LD environment variable.
 352 @@ -171,7 +170,7 @@ $(FIPSCANLIB):      $(FIPSCANLOC)
 353         $(RANLIB) ../$(FIPSCANLIB).a || echo Never mind.
 354         @touch lib
 355
 356 -shared:        lib subdirs fips_premain_dso$(EXE_EXT)
 357 +shared:        lib subdirs
 358
 359  libs:
 360         @target=lib; $(RECURSIVE_MAKE)
 361 @@ -195,10 +194,6 @@ install:
 362         chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i ); \
 363         done;
 364         @target=install; $(RECURSIVE_MAKE)
 365 -       @cp -p -f fipscanister.o fipscanister.o.sha1 fips_premain.c \
 366 -               fips_premain.c.sha1 \
 367 -               $(INSTALL_PREFIX)$(INSTALLTOP)/lib/; \
 368 -       chmod 0444 $(INSTALL_PREFIX)$(INSTALLTOP)/lib/fips*
 369
 370  lint:
 371         @target=lint; $(RECURSIVE_MAKE)
 372 diff -up openssl-0.9.8j/fips/fips_locl.h.use-fipscheck openssl-0.9.8j/fips/fips_locl.h
 373 --- openssl-0.9.8j/fips/fips_locl.h.use-fipscheck       2008-09-16 12:12:10.000000000 +0200
 374 +++ openssl-0.9.8j/fips/fips_locl.h     2009-01-13 22:35:49.000000000 +0100
 375 @@ -63,7 +63,9 @@ int fips_is_owning_thread(void);
 376  int fips_set_owning_thread(void);
 377  void fips_set_selftest_fail(void);
 378  int fips_clear_owning_thread(void);
 379 +#if 0
 380  unsigned char *fips_signature_witness(void);
 381 +#endif
 382
 383  #define FIPS_MAX_CIPHER_TEST_SIZE      16
 384