pool/mozilla-nss
SHA256
2
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=389

Browse Source
This commit is contained in:
Wolfgang Rosenauer 2022-07-26 20:39:35 +00:00 committed by Git OBS Bridge
parent 521f0d9c83
commit e6797bdfe9
1 changed files with 90 additions and 595 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

685
nss-fips-constructor-self-tests.patch
View File

@ -1,13 +1,7 @@
commit d4f90dd0c5e15cfd9db416207d067cc3968b3a0c
Author: Hans Petter Jansson <hpj@cl.no>
Date: Sun Mar 15 21:54:30 2020 +0100
Patch 23: nss-fips-constructor-self-tests.patch
Index: nss/cmd/chktest/chktest.c
===================================================================
--- nss.orig/cmd/chktest/chktest.c
+++ nss/cmd/chktest/chktest.c
diff --git a/cmd/chktest/chktest.c b/cmd/chktest/chktest.c
index a33d184..f09283a 100644
--- a/cmd/chktest/chktest.c
+++ b/cmd/chktest/chktest.c
@@ -38,7 +38,7 @@ main(int argc, char **argv)
}
RNG_SystemInfoForRNG();
@ -17,10 +11,10 @@ Index: nss/cmd/chktest/chktest.c
printf("%s\n",
(good_result ? "SUCCESS" : "FAILURE"));
return (good_result) ? SECSuccess : SECFailure;
Index: nss/cmd/shlibsign/shlibsign.c
===================================================================
--- nss.orig/cmd/shlibsign/shlibsign.c
+++ nss/cmd/shlibsign/shlibsign.c
diff --git a/cmd/shlibsign/shlibsign.c b/cmd/shlibsign/shlibsign.c
index ad8f3b8..a5b42d7 100644
--- a/cmd/shlibsign/shlibsign.c
+++ b/cmd/shlibsign/shlibsign.c
@@ -946,10 +946,12 @@ main(int argc, char **argv)
goto cleanup;
}
@ -38,10 +32,10 @@ Index: nss/cmd/shlibsign/shlibsign.c
}
}
Index: nss/lib/freebl/blapi.h
===================================================================
--- nss.orig/lib/freebl/blapi.h
+++ nss/lib/freebl/blapi.h
diff --git a/lib/freebl/blapi.h b/lib/freebl/blapi.h
index 94fd802..45e1dd1 100644
--- a/lib/freebl/blapi.h
+++ b/lib/freebl/blapi.h
@@ -1759,17 +1759,17 @@ extern void BL_Unload(void);
/**************************************************************************
* Verify a given Shared library signature *
@ -63,7 +57,7 @@ Index: nss/lib/freebl/blapi.h
/*********************************************************************/
extern const SECHashObject *HASH_GetRawHashObject(HASH_HashType hashType);
@@ -1791,6 +1791,9 @@ extern SECStatus EC_CopyParams(PLArenaPo
@@ -1791,6 +1791,9 @@ extern SECStatus EC_CopyParams(PLArenaPool *arena, ECParams *dstParams,
*/
extern int EC_GetPointSize(const ECParams *params);
@ -73,403 +67,10 @@ Index: nss/lib/freebl/blapi.h
SEC_END_PROTOS
#endif /* _BLAPI_H_ */
Index: nss/lib/freebl/fips-selftest.inc
===================================================================
--- /dev/null
+++ nss/lib/freebl/fips-selftest.inc
@@ -0,0 +1,355 @@
+/*
+ * PKCS #11 FIPS Power-Up Self Test - common stuff.
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef FIPS_INC
+#define FIPS_INC
+
+/* common functions used for FIPS selftests. Due to the modular design of NSS
+ * putting these into libfreebl would mean either amending the API represented
+ * by FREEBLVectorStr - which might cause problems with newer applications, or
+ * extending the API with another similar function set. Thus, to make things
+ * less complicated in the binaries, we mess up the source a bit. */
+
+#include <errno.h>
+#include <fcntl.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/stat.h>
+#include <unistd.h>
+#include <limits.h>
+
+#include <prtypes.h>
+#include <prerror.h>
+
+#include <prlink.h>
+
+#include "blapi.h"
+
+#define NSS_FORCE_FIPS_ENV "NSS_FIPS"
+#define FIPS_PROC_PATH "/proc/sys/crypto/fips_enabled"
+
+#define CHECKSUM_SUFFIX ".chk"
+
+typedef enum fips_check_status {
+ CHECK_UNCHECKED = -1,
+ CHECK_OK = 0,
+ CHECK_FAIL,
+ CHECK_FAIL_CRYPTO,
+ CHECK_MISSING
+} fips_check_status;
+
+/* initial value of FIPS state is -1 */
+static int fips_state = -1;
+
+static int fips_wanted = -1;
+
+static int fips_is_env = 0;
+static int fips_ignore_checksums = 0;
+
+/* debug messages are sent to stderr */
+static void
+debug(const char *fmt,...)
+{
+#if 0
+ va_list args;
+
+ va_start(args, fmt);
+ vfprintf(stderr, fmt, args);
+ va_end(args);
+ fputc('\n', stderr);
+#endif
+ return;
+}
+
+/* Fatal messages ending with abort(); this function never returns */
+static void __attribute__ ((__noreturn__))
+fatal(const char *fmt,...)
+{
+ va_list args;
+
+ va_start(args, fmt);
+ vfprintf(stderr, fmt, args);
+ va_end(args);
+ fputc('\n', stderr);
+ abort();
+}
+
+/* check whether FIPS moode is mandated by the kernel */
+static int
+fips_isWantedProc(void)
+{
+ int my_fips_wanted = 0;
+ int fips_fd;
+ char fips_sys = 0;
+
+ struct stat dummy;
+ if (-1 == stat(FIPS_PROC_PATH, &dummy)) {
+ switch (errno) {
+ case ENOENT:
+ case EACCES: /* Mozilla sandboxing returns EACCES instead of ENOENT */
+ case ENOTDIR:
+ break;
+ default:
+ fatal("Check for system-wide FIPS mode is required and %s cannot"
+ " be accessed for reason other than non-existence - aborting"
+ , FIPS_PROC_PATH);
+ break;
+ }
+ } else {
+ if (-1 == (fips_fd = open(FIPS_PROC_PATH, O_RDONLY))) {
+ fatal("Check for system-wide FIPS mode is required and %s cannot"
+ " be opened for reading - aborting"
+ , FIPS_PROC_PATH);
+ }
+ if (1 > read(fips_fd, &fips_sys, 1)) {
+ fatal("Check for system-wide FIPS mode is required and %s doesn't"
+ " return at least one character - aborting"
+ , FIPS_PROC_PATH);
+ }
+ close(fips_fd);
+ switch (fips_sys) {
+ case '0':
+ case '1':
+ my_fips_wanted = fips_sys - '0';
+ break;
+ default:
+ fatal("Bogus character %c found in %s - aborting"
+ , fips_sys, FIPS_PROC_PATH);
+ }
+ }
+ return my_fips_wanted;
+}
+
+/* "legacy" from lib/sysinit/nsssysinit.c */
+static PRBool
+getFIPSEnv(void)
+{
+ char *fipsEnv = getenv("NSS_FIPS");
+ if (!fipsEnv) {
+ return PR_FALSE;
+ }
+ if ((strcasecmp(fipsEnv,"fips") == 0) ||
+ (strcasecmp(fipsEnv,"true") == 0) ||
+ (strcasecmp(fipsEnv,"on") == 0) ||
+ (strcasecmp(fipsEnv,"1") == 0)) {
+ return PR_TRUE;
+ }
+ return PR_FALSE;
+}
+
+static PRBool
+getIgnoreChecksumsEnv(void)
+{
+ char *checksumEnv = getenv("NSS_IGNORE_CHECKSUMS");
+ if (!checksumEnv) {
+ return PR_FALSE;
+ }
+ if ((strcasecmp(checksumEnv,"true") == 0) ||
+ (strcasecmp(checksumEnv,"on") == 0) ||
+ (strcasecmp(checksumEnv,"1") == 0)) {
+ return PR_TRUE;
+ }
+ return PR_FALSE;
+}
+
+static int
+fips_isWantedEnv(void)
+{
+ return getFIPSEnv() ? 1 : 0;
+}
+
+static int
+fips_isWanted(void)
+{
+ int fips_requests = 0;
+#ifdef LINUX
+ fips_requests += fips_isWantedProc();
+#endif
+ if (fips_requests < 1)
+ {
+ fips_is_env = 1;
+ fips_ignore_checksums = getIgnoreChecksumsEnv();
+ }
+ fips_requests += fips_isWantedEnv();
+
+ return fips_requests;
+}
+
+static PRBool
+fips_check_signature_external (const char *full_lib_name, int *err)
+{
+ char *p0, *p1;
+ char *ld_path;
+ PRBool rv = PR_FALSE;
+
+ p0 = getenv ("LD_LIBRARY_PATH");
+ p0 = ld_path = strdup (p0 ? p0 : "");
+
+ for (p1 = strchr (p0, ':'); p1 && !rv; p1 = strchr (p0, ':'))
+ {
+ char *path;
+
+ *p1 = '\0';
+ path = malloc (strlen (p0) + strlen (full_lib_name) + 2);
+ strcpy (path, p0);
+ strcat (path, "/");
+ strcat (path, full_lib_name);
+
+ rv = BLAPI_SHVerifyFile (path, err);
+
+ free (path);
+ p0 = p1 + 1;
+ }
+
+ if (!rv)
+ {
+ char *path = malloc (strlen ("/usr/lib64/") + strlen (full_lib_name) + 1);
+ strcpy (path, "/usr/lib64/");
+ strcat (path, full_lib_name);
+ rv = BLAPI_SHVerifyFile (path, err);
+ }
+
+ free (ld_path);
+ return rv;
+}
+
+/* check integrity signatures (if present) */
+static fips_check_status
+fips_checkSignature(char *libName, PRFuncPtr addr)
+{
+ PRBool rv;
+ fips_check_status rv_check = CHECK_UNCHECKED;
+ int l = PATH_MAX;
+ int err = 0;
+ int err_NOENT = 0;
+ char full_lib_name[PATH_MAX+1];
+ full_lib_name[0] = '\0';
+
+ if (NULL == libName) {
+ err_NOENT = PR_FILE_NOT_FOUND_ERROR;
+ rv = BLAPI_VerifySelf(SHLIB_PREFIX"freebl"SHLIB_VERSION"."SHLIB_SUFFIX, &err);
+ } else {
+ err_NOENT = PR_FILE_NOT_FOUND_ERROR;
+ strncat(full_lib_name, SHLIB_PREFIX, l);
+ l -= strlen(SHLIB_PREFIX);
+ strncat(full_lib_name, libName, l);
+ l -= strlen(libName);
+ strncat(full_lib_name, SHLIB_VERSION"."SHLIB_SUFFIX, l);
+ l -= strlen(SHLIB_VERSION"."SHLIB_SUFFIX);
+
+ if (NULL == addr)
+ rv = fips_check_signature_external (full_lib_name, &err);
+ else
+ rv = BLAPI_SHVerify(full_lib_name, addr, &err);
+ }
+
+ if (rv) {
+ rv_check = CHECK_OK;
+ } else {
+ if (err_NOENT == err) {
+ rv_check = CHECK_MISSING;
+ } else {
+ rv_check = CHECK_FAIL;
+ }
+ }
+
+ return rv_check;
+}
+
+/* decide what to do depending on the results of tests and system/required FIPS
+ * mode */
+static int
+fips_resolve(fips_check_status check, char *libName)
+{
+ int state;
+
+ if (fips_wanted) {
+ switch (check) {
+ case CHECK_OK:
+ debug("fips - %s: mandatory checksum ok"
+ , (libName) ? libName : "freebl");
+ break;
+ case CHECK_FAIL:
+ fatal("fips - %s: mandatory checksum failed - aborting"
+ , (libName) ? libName : "freebl");
+ break;
+ case CHECK_FAIL_CRYPTO:
+ fatal("fips - %s: mandatory crypto test failed - aborting"
+ , (libName) ? libName : "freebl");
+ break;
+ case CHECK_MISSING:
+ fatal("fips - %s: mandatory checksum data missing - aborting"
+ , (libName) ? libName : "freebl");
+ break;
+ default:
+ fatal("Fatal error: internal error at %s:%u"
+ , __FILE__, __LINE__);
+ break;
+ }
+ state = 1;
+ } else {
+ switch (check) {
+ case CHECK_OK:
+ debug("fips - %s: checksum ok"
+ , (libName) ? libName : "freebl");
+ break;
+ case CHECK_FAIL:
+#if 0
+ fatal("fips - %s: checksum failed - aborting"
+ , (libName) ? libName : "freebl");
+#else
+ debug("fips - %s: checksum failed - not in FIPS mode; continuing"
+ , (libName) ? libName : "freebl");
+#endif
+ break;
+ case CHECK_FAIL_CRYPTO:
+ fatal("fips - %s: crypto test failed - aborting"
+ , (libName) ? libName : "freebl");
+ break;
+ case CHECK_MISSING:
+ debug("fips - %s: mandatory checksum data missing, but not required in non FIPS mode; continuing non-FIPS"
+ , (libName) ? libName : "freebl");
+ break;
+ default:
+ fatal("Fatal error: internal error at %s:%u"
+ , __FILE__, __LINE__);
+ break;
+ }
+ state = 0;
+ }
+ return state;
+}
+
+/* generic selftest
+ * libName and addr are the name of shared object to check and a function
+ * contained therein; (NULL, NULL) performs selfcheck of freebl.
+ * crypto_check is callback that performs cryptographic algorithms checks; NULL
+ * for libraries that do not implement any cryptographic algorithms per se
+ */
+static int
+fips_initTest(char *libName, PRFuncPtr addr, fips_check_status cryptoCheck(void))
+{
+ fips_check_status check = CHECK_OK;
+
+ fips_wanted = fips_isWanted();
+
+ if (cryptoCheck) {
+ check = cryptoCheck();
+ debug("fips - %s: crypto check %s"
+ , (libName) ? libName : "freebl"
+ , (CHECK_OK == check) ? "ok" : "failed");
+ }
+
+ if (CHECK_OK == check) {
+ check = fips_checkSignature(libName, addr);
+ }
+
+ return fips_resolve(check, libName);
+}
+
+#endif
Index: nss/lib/freebl/fips.c
===================================================================
--- /dev/null
+++ nss/lib/freebl/fips.c
@@ -0,0 +1,7 @@
+/*
+ * PKCS #11 FIPS Power-Up Self Test.
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
Index: nss/lib/freebl/fips.h
===================================================================
--- /dev/null
+++ nss/lib/freebl/fips.h
@@ -0,0 +1,16 @@
+/*
+ * PKCS #11 FIPS Power-Up Self Test.
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef FIPS_H
+#define FIPS_H
+
+int FIPS_mode(void);
+int FIPS_mode_allow_tests(void);
+char* FIPS_rngDev(void);
+
+#endif
+
Index: nss/lib/freebl/fipsfreebl.c
===================================================================
--- nss.orig/lib/freebl/fipsfreebl.c
+++ nss/lib/freebl/fipsfreebl.c
diff --git a/lib/freebl/fipsfreebl.c b/lib/freebl/fipsfreebl.c
index 23f665a..f080417 100644
--- a/lib/freebl/fipsfreebl.c
+++ b/lib/freebl/fipsfreebl.c
@@ -21,6 +21,13 @@
#include "ec.h" /* Required for EC */
@ -484,7 +85,7 @@ Index: nss/lib/freebl/fipsfreebl.c
/*
* different platforms have different ways of calling and initial entry point
* when the dll/.so is loaded. Most platforms support either a posix pragma
@@ -1998,9 +2005,8 @@ freebl_fips_RNG_PowerUpSelfTest(void)
@@ -1963,9 +1970,8 @@ freebl_fips_RNG_PowerUpSelfTest(void)
0x0a, 0x26, 0x21, 0xd0, 0x19, 0xcb, 0x86, 0x73,
0x10, 0x1f, 0x60, 0xd7
};
@ -495,7 +96,7 @@ Index: nss/lib/freebl/fipsfreebl.c
/*******************************************/
/* Run the SP 800-90 Health tests */
@@ -2014,13 +2020,12 @@ freebl_fips_RNG_PowerUpSelfTest(void)
@@ -1979,13 +1985,12 @@ freebl_fips_RNG_PowerUpSelfTest(void)
/*******************************************/
/* Generate DSAX fow given Q. */
/*******************************************/
@ -510,7 +111,7 @@ Index: nss/lib/freebl/fipsfreebl.c
PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
return SECFailure;
}
@@ -2028,17 +2033,19 @@ freebl_fips_RNG_PowerUpSelfTest(void)
@@ -1993,17 +1998,19 @@ freebl_fips_RNG_PowerUpSelfTest(void)
return (SECSuccess);
}
@ -531,7 +132,7 @@ Index: nss/lib/freebl/fipsfreebl.c
#define DO_FREEBL 1
#define DO_REST 2
@@ -2156,11 +2163,13 @@ static PRBool self_tests_ran = PR_FALSE;
@@ -2121,11 +2128,13 @@ static PRBool self_tests_ran = PR_FALSE;
static PRBool self_tests_freebl_success = PR_FALSE;
static PRBool self_tests_success = PR_FALSE;
@ -546,7 +147,7 @@ Index: nss/lib/freebl/fipsfreebl.c
{
SECStatus rv;
/* if the freebl self tests didn't run, there is something wrong with
@@ -2173,7 +2182,7 @@ BL_POSTRan(PRBool freebl_only)
@@ -2138,7 +2147,7 @@ BL_POSTRan(PRBool freebl_only)
return PR_TRUE;
}
/* if we only care about the freebl tests, we are good */
@ -555,7 +156,7 @@ Index: nss/lib/freebl/fipsfreebl.c
return PR_TRUE;
}
/* run the rest of the self tests */
@@ -2192,32 +2201,16 @@ BL_POSTRan(PRBool freebl_only)
@@ -2157,32 +2166,16 @@ BL_POSTRan(PRBool freebl_only)
return PR_TRUE;
}
@ -593,7 +194,7 @@ Index: nss/lib/freebl/fipsfreebl.c
self_tests_freebl_ran = PR_TRUE; /* we are running the tests */
if (!freebl_only) {
@@ -2229,20 +2222,55 @@ bl_startup_tests(void)
@@ -2194,20 +2187,55 @@ bl_startup_tests(void)
/* always run the post tests */
rv = freebl_fipsPowerUpSelfTest(freebl_only ? DO_FREEBL : DO_FREEBL | DO_REST);
if (rv != SECSuccess) {
@ -651,7 +252,7 @@ Index: nss/lib/freebl/fipsfreebl.c
}
/*
@@ -2251,28 +2279,110 @@ bl_startup_tests(void)
@@ -2216,28 +2244,110 @@ bl_startup_tests(void)
* power on selftest failed.
*/
SECStatus
@ -772,10 +373,28 @@ Index: nss/lib/freebl/fipsfreebl.c
+}
+
#endif
Index: nss/lib/freebl/loader.c
===================================================================
--- nss.orig/lib/freebl/loader.c
+++ nss/lib/freebl/loader.c
diff --git a/lib/freebl/ldvector.c b/lib/freebl/ldvector.c
index ac3b862..8f3518b 100644
--- a/lib/freebl/ldvector.c
+++ b/lib/freebl/ldvector.c
@@ -376,9 +376,12 @@ static const struct FREEBLVectorStr vector =
/* End of version 3.024 */
ChaCha20_InitContext,
ChaCha20_CreateContext,
- ChaCha20_DestroyContext
+ ChaCha20_DestroyContext,
/* End of version 3.025 */
+
+ /* SUSE patch: Goes last */
+ BL_FIPSRepeatIntegrityCheck
};
const FREEBLVector*
diff --git a/lib/freebl/loader.c b/lib/freebl/loader.c
index 692a883..deca671 100644
--- a/lib/freebl/loader.c
+++ b/lib/freebl/loader.c
@@ -95,6 +95,14 @@ BL_Init(void)
return (vector->p_BL_Init)();
}
@ -784,14 +403,14 @@ Index: nss/lib/freebl/loader.c
+BL_FIPSRepeatIntegrityCheck(void)
+{
+ if (!vector && PR_SUCCESS != freebl_RunLoaderOnce())
+ return SECFailure;
+ return;
+ (vector->p_BL_FIPSRepeatIntegrityCheck)();
+}
+
RSAPrivateKey *
RSA_NewKey(int keySizeInBits, SECItem *publicExponent)
{
@@ -1213,11 +1221,11 @@ AESKeyWrap_DecryptKWP(AESKeyWrapContext
@@ -1213,11 +1221,11 @@ AESKeyWrap_DecryptKWP(AESKeyWrapContext *cx, unsigned char *output,
}
PRBool
@ -805,7 +424,7 @@ Index: nss/lib/freebl/loader.c
}
/*
@@ -1227,12 +1235,12 @@ BLAPI_SHVerify(const char *name, PRFuncP
@@ -1227,12 +1235,12 @@ BLAPI_SHVerify(const char *name, PRFuncPtr addr)
* in freebl_LoadDSO) to p_BLAPI_VerifySelf.
*/
PRBool
@ -820,7 +439,7 @@ Index: nss/lib/freebl/loader.c
}
/* ============== New for 3.006 =============================== */
@@ -1836,11 +1844,11 @@ SHA224_Clone(SHA224Context *dest, SHA224
@@ -1836,11 +1844,11 @@ SHA224_Clone(SHA224Context *dest, SHA224Context *src)
}
PRBool
@ -834,10 +453,10 @@ Index: nss/lib/freebl/loader.c
}
/* === new for DSA-2 === */
Index: nss/lib/freebl/loader.h
===================================================================
--- nss.orig/lib/freebl/loader.h
+++ nss/lib/freebl/loader.h
diff --git a/lib/freebl/loader.h b/lib/freebl/loader.h
index eb3046d..3bbc43a 100644
--- a/lib/freebl/loader.h
+++ b/lib/freebl/loader.h
@@ -299,8 +299,8 @@ struct FREEBLVectorStr {
/* Version 3.004 came to here */
@ -868,10 +487,10 @@ Index: nss/lib/freebl/loader.h
};
typedef struct FREEBLVectorStr FREEBLVector;
Index: nss/lib/freebl/manifest.mn
===================================================================
--- nss.orig/lib/freebl/manifest.mn
+++ nss/lib/freebl/manifest.mn
diff --git a/lib/freebl/manifest.mn b/lib/freebl/manifest.mn
index b6c5fb3..b8ba60b 100644
--- a/lib/freebl/manifest.mn
+++ b/lib/freebl/manifest.mn
@@ -97,6 +97,7 @@ PRIVATE_EXPORTS = \
ecl.h \
ecl-curve.h \
@ -888,10 +507,10 @@ Index: nss/lib/freebl/manifest.mn
$(NULL)
Index: nss/lib/freebl/shvfy.c
===================================================================
--- nss.orig/lib/freebl/shvfy.c
+++ nss/lib/freebl/shvfy.c
diff --git a/lib/freebl/shvfy.c b/lib/freebl/shvfy.c
index 0428bf6..f463352 100644
--- a/lib/freebl/shvfy.c
+++ b/lib/freebl/shvfy.c
@@ -22,6 +22,8 @@
#ifndef NSS_FIPS_DISABLED
@ -901,7 +520,7 @@ Index: nss/lib/freebl/shvfy.c
/*
* Most modern version of Linux support a speed optimization scheme where an
* application called prelink modifies programs and shared libraries to quickly
@@ -231,8 +233,6 @@ bl_CloseUnPrelink(PRFileDesc *file, int
@@ -231,8 +233,6 @@ bl_CloseUnPrelink(PRFileDesc *file, int pid)
}
#endif
@ -959,7 +578,7 @@ Index: nss/lib/freebl/shvfy.c
{
char *checkName = NULL;
PRFileDesc *checkFD = NULL;
@@ -341,7 +341,7 @@ blapi_SHVerifyFile(const char *shName, P
@@ -341,7 +341,7 @@ blapi_SHVerifyFile(const char *shName, PRBool self)
#endif
PRBool result = PR_FALSE; /* if anything goes wrong,
@ -968,7 +587,7 @@ Index: nss/lib/freebl/shvfy.c
unsigned char buf[4096];
unsigned char hashBuf[HASH_LENGTH_MAX];
@@ -368,14 +368,17 @@ blapi_SHVerifyFile(const char *shName, P
@@ -368,14 +368,17 @@ blapi_SHVerifyFile(const char *shName, PRBool self)
/* open the check File */
checkFD = PR_Open(checkName, PR_RDONLY, 0);
if (checkFD == NULL) {
@ -989,7 +608,7 @@ Index: nss/lib/freebl/shvfy.c
bytesRead = PR_Read(checkFD, buf, 12);
if (bytesRead != 12) {
goto loser;
@@ -416,7 +419,8 @@ blapi_SHVerifyFile(const char *shName, P
@@ -416,7 +419,8 @@ blapi_SHVerifyFile(const char *shName, PRBool self)
if (rv != SECSuccess) {
goto loser;
}
@ -999,7 +618,7 @@ Index: nss/lib/freebl/shvfy.c
rv = readItem(checkFD, &signature);
if (rv != SECSuccess) {
goto loser;
@@ -431,7 +435,7 @@ blapi_SHVerifyFile(const char *shName, P
@@ -431,7 +435,7 @@ blapi_SHVerifyFile(const char *shName, PRBool self)
goto loser;
}
@ -1008,7 +627,7 @@ Index: nss/lib/freebl/shvfy.c
#ifdef FREEBL_USE_PRELINK
shFD = bl_OpenUnPrelink(shName, &pid);
#else
@@ -439,13 +443,13 @@ blapi_SHVerifyFile(const char *shName, P
@@ -439,13 +443,13 @@ blapi_SHVerifyFile(const char *shName, PRBool self)
#endif
if (shFD == NULL) {
#ifdef DEBUG_SHVERIFY
@ -1043,76 +662,10 @@ Index: nss/lib/freebl/shvfy.c
}
#else /* NSS_FIPS_DISABLED */
Index: nss/lib/softoken/fips.c
===================================================================
--- /dev/null
+++ nss/lib/softoken/fips.c
@@ -0,0 +1,46 @@
+#include "../freebl/fips-selftest.inc"
+
+#include "fips.h"
+
+#include "softoken.h"
+
+#include <dlfcn.h>
+
+/* crypto algorithms selftest wrapper */
+static fips_check_status
+fips_checkCryptoSoftoken(void)
+{
+ if (CKR_OK == sftk_FIPSEntryOK()) {
+ return CHECK_OK;
+ } else {
+ return CHECK_FAIL_CRYPTO;
+ }
+
+ return CHECK_OK;
+}
+
+/* constructor - load-time selfchecks */
+static void __attribute__ ((constructor))
+fips_initTestSoftoken(void)
+{
+ fips_state = fips_initTest("softokn", (PRFuncPtr)fips_initTestSoftoken, fips_checkCryptoSoftoken);
+
+ /* The legacy DB must be checked unconditionally in FIPS mode. As an exception,
+ * this can be turned off for the build-time tests using the env var
+ * NSS_IGNORE_CHECKSUMS. This is necessary because the files cannot be
+ * located before they're installed. It only works if FIPS mode is enabled
+ * via NSS_FIPS=1, not if it's set in /proc. */
+
+ if (fips_state && !(fips_is_env && fips_ignore_checksums))
+ {
+ fips_state = fips_initTest("nssdbm", (PRFuncPtr) NULL, NULL);
+ }
+
+ return;
+}
+
+void
+fips_repeatTestSoftoken(void)
+{
+ fips_initTestSoftoken();
+}
Index: nss/lib/softoken/fips.h
===================================================================
--- /dev/null
+++ nss/lib/softoken/fips.h
@@ -0,0 +1,10 @@
+#ifndef FIPS_H
+#define FIPS_H
+
+#include "softoken.h"
+
+CK_RV FIPS_cryptoSelftestSoftoken(void);
+CK_RV sftk_fipsPowerUpSelfTest(void);
+
+#endif
+
Index: nss/lib/softoken/fipstest.c
===================================================================
--- nss.orig/lib/softoken/fipstest.c
+++ nss/lib/softoken/fipstest.c
diff --git a/lib/softoken/fipstest.c b/lib/softoken/fipstest.c
index aa4992c..ab3b693 100644
--- a/lib/softoken/fipstest.c
+++ b/lib/softoken/fipstest.c
@@ -682,6 +682,327 @@ sftk_fips_HKDF_PowerUpSelfTest(void)
return (SECSuccess);
}
@ -1519,50 +1072,10 @@ Index: nss/lib/softoken/fipstest.c
#else
#include "pkcs11t.h"
CK_RV
Index: nss/lib/softoken/legacydb/fips.c
===================================================================
--- /dev/null
+++ nss/lib/softoken/legacydb/fips.c
@@ -0,0 +1,25 @@
+#include "../../freebl/fips-selftest.inc"
+
+#include "fips.h"
+
+/*** private per-module symbols ***/
+
+/* crypto algorithms selftest wrapper */
+static fips_check_status
+fips_checkCryptoDbm(void)
+{
+ /* no checks in dbm */
+ return CHECK_OK;
+}
+
+/* constructor - load-time selfchecks */
+static void __attribute__ ((constructor))
+fips_initTestDbm(void)
+{
+ fips_state = fips_initTest("nssdbm", (PRFuncPtr)fips_checkCryptoDbm, NULL);
+
+ return;
+}
+
+/*** public per-module symbols ***/
+
Index: nss/lib/softoken/legacydb/fips.h
===================================================================
--- /dev/null
+++ nss/lib/softoken/legacydb/fips.h
@@ -0,0 +1,5 @@
+#ifndef FIPS_H
+#define FIPS_H
+
+#endif
+
Index: nss/lib/softoken/legacydb/lgfips.c
===================================================================
--- nss.orig/lib/softoken/legacydb/lgfips.c
+++ nss/lib/softoken/legacydb/lgfips.c
diff --git a/lib/softoken/legacydb/lgfips.c b/lib/softoken/legacydb/lgfips.c
index b991dcf..efb7e52 100644
--- a/lib/softoken/legacydb/lgfips.c
+++ b/lib/softoken/legacydb/lgfips.c
@@ -90,7 +90,7 @@ lg_startup_tests(void)
/* no self tests required for the legacy db, only the integrity check */
@ -1572,10 +1085,10 @@ Index: nss/lib/softoken/legacydb/lgfips.c
/* something is wrong with the library, fail without enabling
* the fips token */
return;
Index: nss/lib/softoken/legacydb/manifest.mn
===================================================================
--- nss.orig/lib/softoken/legacydb/manifest.mn
+++ nss/lib/softoken/legacydb/manifest.mn
diff --git a/lib/softoken/legacydb/manifest.mn b/lib/softoken/legacydb/manifest.mn
index caac524..16c8847 100644
--- a/lib/softoken/legacydb/manifest.mn
+++ b/lib/softoken/legacydb/manifest.mn
@@ -12,7 +12,7 @@ LIBRARY_NAME = nssdbm
LIBRARY_VERSION = 3
MAPFILE = $(OBJDIR)/$(LIBRARY_NAME).def
@ -1592,10 +1105,10 @@ Index: nss/lib/softoken/legacydb/manifest.mn
+ fips.c \
$(NULL)
Index: nss/lib/softoken/manifest.mn
===================================================================
--- nss.orig/lib/softoken/manifest.mn
+++ nss/lib/softoken/manifest.mn
diff --git a/lib/softoken/manifest.mn b/lib/softoken/manifest.mn
index 34daf1c..c4c89fc 100644
--- a/lib/softoken/manifest.mn
+++ b/lib/softoken/manifest.mn
@@ -31,6 +31,7 @@ PRIVATE_EXPORTS = \
softkver.h \
sdb.h \
@ -1612,11 +1125,11 @@ Index: nss/lib/softoken/manifest.mn
$(NULL)
ifndef NSS_DISABLE_DBM
Index: nss/lib/softoken/softoken.h
===================================================================
--- nss.orig/lib/softoken/softoken.h
+++ nss/lib/softoken/softoken.h
@@ -59,6 +59,9 @@ extern unsigned char *CBC_PadBuffer(PLAr
diff --git a/lib/softoken/softoken.h b/lib/softoken/softoken.h
index 30586fc..f6d4a4c 100644
--- a/lib/softoken/softoken.h
+++ b/lib/softoken/softoken.h
@@ -59,6 +59,9 @@ extern unsigned char *CBC_PadBuffer(PLArenaPool *arena, unsigned char *inbuf,
/* make sure Power-up selftests have been run. */
extern CK_RV sftk_FIPSEntryOK(void);
@ -1626,21 +1139,3 @@ Index: nss/lib/softoken/softoken.h
/*
** make known fixed PKCS #11 key types to their sizes in bytes
*/
Index: nss/lib/freebl/ldvector.c
===================================================================
--- nss.orig/lib/freebl/ldvector.c
+++ nss/lib/freebl/ldvector.c
@@ -376,9 +376,12 @@ static const struct FREEBLVectorStr vect
/* End of version 3.024 */
ChaCha20_InitContext,
ChaCha20_CreateContext,
- ChaCha20_DestroyContext
+ ChaCha20_DestroyContext,
/* End of version 3.025 */
+
+ /* SUSE patch: Goes last */
+ BL_FIPSRepeatIntegrityCheck
};
const FREEBLVector*