Repository navigation
Do not register MD5, MD5-SHA1 and DES3 in FIPS builds - #523
Open
padelsbach wants to merge 1 commit into
Open
padelsbach wants to merge 1 commit into
padelsbach wants to merge 1 commit into
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
With TEST_MULTITHREADED enabled, three formatted diagnostics in test/test_fetch.c pass multiple arguments to the single-parameter PRINT_ERR_MSG macro, causing preprocessing to fail.
1 open issue
What changed in this PR
This PR stops wolfProvider from advertising unavailable MD5, MD5-SHA1, and DES3 implementations in FIPS builds, preventing fetch failures from leaving errors that disrupt the first TLS connection.
Changes:
- Restrict algorithm registration in FIPS builds unless
WP_ALLOW_NON_FIPSis enabled. - Remove the corresponding failure-only dispatch implementations.
- Add a registered-algorithm fetch test and integrate it into both build systems.
| File | Description |
|---|---|
test/unit.h |
Declare the new fetch test. |
test/unit.c |
Register the fetch test in the unit suite. |
test/test_fetch.c |
Check that every registered digest and cipher is fetchable. |
test/include.am |
Include the fetch test in Automake builds. |
src/wp_wolfprov.c |
Gate MD5, MD5-SHA1, and DES3 registration in FIPS builds. |
src/wp_digests.c |
Remove failure-only digest dispatch implementations. |
src/wp_des.c |
Remove the failure-only DES3 dispatch implementation. |
IDE/WINVS/unit-test/unit-test.vcxproj |
Include the fetch test in Visual Studio builds. |
Review effort: Balanced
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

get_paramsreturned 0 for these algs and drops the algs when init'ing the digest/cipher. It also leaves an error in the queue, and a non-blocking app will seeSSL_ERROR_SSLand error"OpenSSL Error: error:030000E1:digital envelope routines::cache constants failed"on its first TLS connection.Fixes zd 22723