Skip to content

Do not register MD5, MD5-SHA1 and DES3 in FIPS builds - #523

Open
padelsbach wants to merge 1 commit into
wolfSSL:masterfrom
padelsbach:get-params-ret-0
Open

padelsbach wants to merge 1 commit into
wolfSSL:masterfrom
padelsbach:get-params-ret-0

Conversation

@padelsbach

Copy link
Copy Markdown
Contributor

get_params returned 0 for these algs and drops the algs when init'ing the digest/cipher. It also leaves an error in the queue, and a non-blocking app will see SSL_ERROR_SSL and error "OpenSSL Error: error:030000E1:digital envelope routines::cache constants failed" on its first TLS connection.

Fixes zd 22723

Copilot AI balanced review requested due to automatic review settings October 30, 2026 23:32

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

With TEST_MULTITHREADED enabled, three formatted diagnostics in test/test_fetch.c pass multiple arguments to the single-parameter PRINT_ERR_MSG macro, causing preprocessing to fail.

1 open issue
What changed in this PR

This PR stops wolfProvider from advertising unavailable MD5, MD5-SHA1, and DES3 implementations in FIPS builds, preventing fetch failures from leaving errors that disrupt the first TLS connection.

Changes:

  • Restrict algorithm registration in FIPS builds unless WP_ALLOW_NON_FIPS is enabled.
  • Remove the corresponding failure-only dispatch implementations.
  • Add a registered-algorithm fetch test and integrate it into both build systems.
File Description
test/​unit.h Declare the new fetch test.
test/​unit.c Register the fetch test in the unit suite.
test/​test_fetch.c Check that every registered digest and cipher is fetchable.
test/​include.am Include the fetch test in Automake builds.
src/​wp_wolfprov.c Gate MD5, MD5-SHA1, and DES3 registration in FIPS builds.
src/​wp_digests.c Remove failure-only digest dispatch implementations.
src/​wp_des.c Remove the failure-only DES3 dispatch implementation.
IDE/​WINVS/​unit-test/​unit-test.vcxproj Include the fetch test in Visual Studio builds.

Review effort: Balanced

Comment thread test/test_fetch.c Resolved
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants